Qiita Article - Why Simply Adding AI on Top of SIEM Is Not Enough

I recently published a new article on Qiita about why simply adding AI on top of SIEM is not enough.

The article organizes seven design points for building an AI layer that can operate reliably in production. It explains why raw SIEM alerts should be normalized, aggregated, enriched with entity history and organizational baselines, and correlated into cases before being sent to an LLM.

It also covers constrained outputs and validation, the separation of human-readable explanations from audit trails, and how to connect AI recommendations to actions through policy checks, approvals, access controls, and execution tracking.

The central idea is that a production-ready SIEM and AI solution is a complete pipeline: preprocessing, context enrichment, LLM analysis, validation, and action—not simply SIEM data sent directly to an LLM.

Read the full article on Qiita.