{"id":"https://openalex.org/W7217517047","doi":null,"title":"SIEM Workflow Optimization and Threat Intelligence for Cloud Incident Response: Approaches to Correlation Automation, Triage Reduction, and Cloud Infrastructure Resilience","display_name":"SIEM Workflow Optimization and Threat Intelligence for Cloud Incident Response: Approaches to Correlation Automation, Triage Reduction, and Cloud Infrastructure Resilience","publication_year":2026,"publication_date":"2026-04-07","ids":{"openalex":"https://openalex.org/W7217517047"},"language":"en","primary_location":{"id":"pmh:oai:ojs2.irjernet.com:article/521","doi":null,"is_oa":true,"landing_page_url":"https://irjernet.com/index.php/fecsit/article/view/521","pdf_url":"https://irjernet.com/index.php/fecsit/article/view/521/470","source":{"id":"https://openalex.org/S5407051331","display_name":"Frontiers in Emerging Computer Science and Information Technology","issn_l":"2978-3712","issn":["2978-3712"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2978-3712","raw_type":"info:eu-repo/semantics/article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://irjernet.com/index.php/fecsit/article/view/521/470","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5146149444","display_name":"Kateryna Oblakevych","orcid":"https://orcid.org/0009-0001-2927-1045","observed_orcids":["https://orcid.org/0009-0001-2927-1045"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Oblakevych, Kateryna","raw_affiliation_strings":["-Software Engineer Seattle , WA , USA","Centific , Redmond , WA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"-Software Engineer Seattle , WA , USA","institution_ids":[]},{"raw_affiliation_string":"Centific , Redmond , WA","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5146149444"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9897000193595886,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9897000193595886,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11614","display_name":"Cloud Data Security Solutions","score":0.0024999999441206455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0019000000320374966,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/security-information-and-event-management","display_name":"security information and event management","score":0.8759999871253967},{"id":"https://openalex.org/keywords/threat-intelligence","display_name":"threat intelligence","score":0.6320000290870667},{"id":"https://openalex.org/keywords/incident-triage","display_name":"incident triage","score":0.9350000023841858},{"id":"https://openalex.org/keywords/machine-learning-for-security","display_name":"machine learning for security","score":0.6819999814033508},{"id":"https://openalex.org/keywords/false-positive-reduction","display_name":"false positive reduction","score":0.7200000286102295},{"id":"https://openalex.org/keywords/zero-trust-architecture","display_name":"zero-trust architecture","score":0.7210000157356262},{"id":"https://openalex.org/keywords/hashicorp-vault","display_name":"HashiCorp Vault","score":0.9729999899864197},{"id":"https://openalex.org/keywords/mitre-att-ck","display_name":"MITRE ATT&CK","score":0.9750000238418579},{"id":"https://openalex.org/keywords/security-operations-center","display_name":"security operations center","score":0.6470000147819519},{"id":"https://openalex.org/keywords/multi-cloud-security","display_name":"multi-cloud security","score":0.8289999961853027}],"concepts":[{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.7671999931335449},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6500999927520752},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.6395000219345093},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.6201000213623047},{"id":"https://openalex.org/C2777120189","wikidata":"https://www.wikidata.org/wiki/Q780067","display_name":"Triage","level":2,"score":0.5284000039100647},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.49050000309944153},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.4799000024795532},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.4796000123023987},{"id":"https://openalex.org/C2780952636","wikidata":"https://www.wikidata.org/wiki/Q13479512","display_name":"Incident management","level":2,"score":0.4569000005722046},{"id":"https://openalex.org/C2985105721","wikidata":"https://www.wikidata.org/wiki/Q13479512","display_name":"Incident response","level":2,"score":0.4320000112056732},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.40869998931884766},{"id":"https://openalex.org/C70388272","wikidata":"https://www.wikidata.org/wiki/Q5968558","display_name":"IBM","level":2,"score":0.39879998564720154},{"id":"https://openalex.org/C2778143579","wikidata":"https://www.wikidata.org/wiki/Q831801","display_name":"Business continuity","level":2,"score":0.38100001215934753},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.37139999866485596},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.36169999837875366},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.3481999933719635},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.32749998569488525},{"id":"https://openalex.org/C121017731","wikidata":"https://www.wikidata.org/wiki/Q11661","display_name":"Information technology","level":2,"score":0.30489999055862427},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.3021000027656555},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.29820001125335693},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.29330000281333923},{"id":"https://openalex.org/C39358052","wikidata":"https://www.wikidata.org/wiki/Q2578632","display_name":"Information security audit","level":5,"score":0.29249998927116394},{"id":"https://openalex.org/C178148461","wikidata":"https://www.wikidata.org/wiki/Q1632136","display_name":"Security controls","level":3,"score":0.29030001163482666},{"id":"https://openalex.org/C134503902","wikidata":"https://www.wikidata.org/wiki/Q1473265","display_name":"Information technology management","level":4,"score":0.2831000089645386},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.28290000557899475},{"id":"https://openalex.org/C153740404","wikidata":"https://www.wikidata.org/wiki/Q671224","display_name":"Data center","level":2,"score":0.2818000018596649},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.2815000116825104},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.2802000045776367},{"id":"https://openalex.org/C46934059","wikidata":"https://www.wikidata.org/wiki/Q61515","display_name":"Outsourcing","level":2,"score":0.273499995470047},{"id":"https://openalex.org/C106201281","wikidata":"https://www.wikidata.org/wiki/Q336119","display_name":"Business operations","level":2,"score":0.27129998803138733},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.26739999651908875},{"id":"https://openalex.org/C2767350","wikidata":"https://www.wikidata.org/wiki/Q6662173","display_name":"Business intelligence","level":2,"score":0.2651999890804291},{"id":"https://openalex.org/C85345410","wikidata":"https://www.wikidata.org/wiki/Q851587","display_name":"Business process","level":3,"score":0.2606000006198883},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.2605000138282776},{"id":"https://openalex.org/C129230348","wikidata":"https://www.wikidata.org/wiki/Q1140205","display_name":"Disaster recovery","level":2,"score":0.257099986076355},{"id":"https://openalex.org/C83163435","wikidata":"https://www.wikidata.org/wiki/Q3954104","display_name":"Security management","level":2,"score":0.2549000084400177},{"id":"https://openalex.org/C2780795517","wikidata":"https://www.wikidata.org/wiki/Q6030997","display_name":"Information assurance","level":3,"score":0.2531999945640564}],"mesh":[],"locations_count":1,"locations":[{"id":"pmh:oai:ojs2.irjernet.com:article/521","doi":null,"is_oa":true,"landing_page_url":"https://irjernet.com/index.php/fecsit/article/view/521","pdf_url":"https://irjernet.com/index.php/fecsit/article/view/521/470","source":{"id":"https://openalex.org/S5407051331","display_name":"Frontiers in Emerging Computer Science and Information Technology","issn_l":"2978-3712","issn":["2978-3712"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2978-3712","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"pmh:oai:ojs2.irjernet.com:article/521","doi":null,"is_oa":true,"landing_page_url":"https://irjernet.com/index.php/fecsit/article/view/521","pdf_url":"https://irjernet.com/index.php/fecsit/article/view/521/470","source":{"id":"https://openalex.org/S5407051331","display_name":"Frontiers in Emerging Computer Science and Information Technology","issn_l":"2978-3712","issn":["2978-3712"],"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2978-3712","raw_type":"info:eu-repo/semantics/article"},"sustainable_development_goals":[],"study_designs":[{"display_name":"Systematic Review","id":"https://openalex.org/study-designs/systematic-review"}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7217517047.pdf","grobid_xml":"https://content.openalex.org/works/W7217517047.grobid-xml"},"referenced_works_count":17,"referenced_works":["https://openalex.org/W3179245071","https://openalex.org/W3199174176","https://openalex.org/W4294958289","https://openalex.org/W4309756669","https://openalex.org/W4313343344","https://openalex.org/W4360841606","https://openalex.org/W4381569470","https://openalex.org/W4386553874","https://openalex.org/W4387428525","https://openalex.org/W4396887447","https://openalex.org/W4399187206","https://openalex.org/W4399619764","https://openalex.org/W4400679744","https://openalex.org/W4401426188","https://openalex.org/W4408343551","https://openalex.org/W7123362503","https://openalex.org/W7126404351"],"related_works":["https://openalex.org/W7166722930","https://openalex.org/W7213125775","https://openalex.org/W7126026060","https://openalex.org/W7217045610","https://openalex.org/W7163156991","https://openalex.org/W7208774421","https://openalex.org/W7117414583","https://openalex.org/W7083458861","https://openalex.org/W7215065779","https://openalex.org/W3013913907"],"abstract_inverted_index":{"Cloud":[0],"infrastructure":[1],"faces":[2],"a":[3,34,76,102,183],"growing":[4],"volume":[5],"of":[6,33,55,106,115,121,157],"security":[7,128,195,197,206],"events":[8],"that":[9,132],"legacy":[10],"rule-based":[11],"Security":[12],"Information":[13],"and":[14,58,84,95,119,153,178,201],"Event":[15],"Management":[16],"(SIEM)":[17],"systems":[18],"struggle":[19],"to":[20,29,68,90,111,142,146,193],"process":[21],"in":[22,72],"time":[23,94,139],"for":[24,52,208],"effective":[25],"incident":[26,92,186],"response.":[27],"According":[28],"the":[30,39],"IBM":[31],"Cost":[32],"Data":[35],"Breach":[36],"Report":[37],"2024,":[38],"global":[40],"average":[41],"breach":[42,59],"cost":[43],"reached":[44],"USD":[45],"4.88":[46],"million,":[47],"with":[48,75],"multi-cloud":[49],"environments":[50],"accounting":[51],"40":[53],"percent":[54,144],"affected":[56],"organizations":[57,202],"lifecycles":[60],"averaging":[61],"258":[62],"days.":[63],"This":[64],"article":[65],"examines":[66],"approaches":[67],"SIEM":[69,134],"workflow":[70],"optimization":[71],"cloud":[73,126,185,194,210],"environments,":[74],"focus":[77],"on":[78],"automated":[79,155],"correlation,":[80],"behavior-based":[81],"anomaly":[82],"scoring,":[83],"threat":[85],"intelligence":[86],"integration":[87],"as":[88],"means":[89],"reduce":[91,137],"triage":[93,138],"improve":[96],"response":[97,187],"quality.":[98],"The":[99,160,189],"methodology":[100],"combines":[101],"systematic":[103],"literature":[104],"review":[105],"peer-reviewed":[107],"publications":[108],"from":[109,125],"2019":[110],"2025,":[112],"content":[113],"analysis":[114],"industry":[116],"benchmark":[117],"reports,":[118],"synthesis":[120],"practical":[122],"engineering":[123],"experience":[124],"data":[127],"initiatives.":[129],"Results":[130],"show":[131],"ML-augmented":[133],"architectures":[135],"can":[136],"by":[140],"45":[141],"78":[143],"compared":[145],"manual":[147],"processes,":[148],"lower":[149],"false-positive":[150],"rates":[151],"significantly,":[152],"support":[154],"containment":[156],"priority-one":[158],"incidents.":[159],"study":[161],"proposes":[162],"an":[163],"integrated":[164],"model":[165],"linking":[166],"Zero":[167],"Trust":[168],"access":[169],"controls,":[170],"Kubernetes":[171],"audit":[172],"logging,":[173],"HashiCorp":[174],"Vault":[175],"secrets":[176],"management,":[177],"MITRE":[179],"ATT&CK-enriched":[180],"correlation":[181],"into":[182],"coherent":[184],"architecture.":[188],"findings":[190],"are":[191],"relevant":[192],"engineers,":[196],"operations":[198,207],"center":[199],"analysts,":[200],"building":[203],"or":[204],"modernizing":[205],"critical":[209],"systems.":[211]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-10-03T00:00:00"}