Autonomous Zero-Trust Threat Classification and Remediation Orchestration via LLM-Augmented SOC

The deployment built an LLM-augmented triage layer positioned between the SIEM alert stream and the human analyst queue. A fine-tuned GPT-4o model — trained on 14 months of the organisation's own labelled alert history (1.8M events, 94K confirmed true positives) — performed initial alert classification, assigning each event a threat typology, confidence score, and recommended containment action from a pre-approved remediation playbook library of 340 actions. Alerts scoring above 0.94 confidence with a playbook match triggered automated remediation via a Tines SOAR integration without human intervention. Claude 3.5 Sonnet handled complex multi-signal correlation tasks: connecting alerts across the IT/OT boundary, identifying lateral movement patterns, and generating natural-language incident narratives for analyst review. All inference ran within the organisation's Azure Government private tenant. A Pinecone vector index stored behavioural fingerprints for 12,400 internal assets, enabling anomaly scoring against established baselines. LangSmith provided complete audit trails on every automated remediation action — a SOC 2 Type II compliance requirement. The system was deployed in shadow mode for 21 days before live remediation authority was granted.