Automated Alert-to-Ticket Pipeline
An LLM-driven triage service that connects detection output to the tools teams already work in.
The problem
Detection produces a firehose of alerts, and analysts end up living in yet another console to watch them. Raw alerts are noisy, repetitive, and disconnected from the tools where work actually gets tracked, so triage becomes copy-paste and context-switching. The signal is there; the workflow around it is the bottleneck.
What I built
An agent-assisted service that sits between detection and the team's own tooling. It ingests security alerts, uses an LLM to classify and enrich each one, deduplicates against what is already open, and opens a structured GitHub issue for an analyst to pick up.
- Classification and enrichment give each alert a title, a category, and the context an analyst needs to start, rather than a raw payload.
- Deduplication means a recurring signal updates one issue instead of spawning fifty.
- The output is a normal GitHub issue, so it slots into the board, assignments, and workflow the team already uses.
The idea behind it
The value is not a smarter model, it is meeting analysts where they already are. Connecting detection output to the tools teams work in removes the friction that makes good alerts get ignored.