Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model
Researchers evaluate a rule-engine and local-LLM incident response subsystem with human approval and safety controls.
A cs.CR paper designs a post-alert incident orchestration subsystem for educational systems that separates classification, contextual analysis, human approval, and technical execution. A rule engine sets severity and selects playbooks, while static RAG and a local large language model provide advice behind validator, guardrail, sanitizer, and safe-fallback controls. Lab tests began from simulated alerts stored in Elasticsearch. The rule engine matched all 30 boundary cases, a durable queue finished 100 events cleanly, and 30 runs averaged about 33 seconds.
- Rule engine matched the routing matrix in all 30 boundary cases.
- Queue completed 100 events without duplicates, failures, or unintended firewall rules.
- An eight-alert test kept only one active local-model request.
- Mean post-alert processing time was about 33 seconds over 30 runs.
Full article140 words · extracted from arxiv.org · click to collapse
This paper presents a controlled post-alert incident orchestration and response subsystem for educational information systems. The architecture separates deterministic classification, contextual analysis, human approval, and technical execution. A Rule Engine determines severity and selects the playbook, while Static RAG and a local large language model provide advisory content under Validator, Guardrail, Output Sanitizer, and Safe Fallback controls. Experiments begin after simulated alerts are stored in Elasticsearch. The Rule Engine matched the predefined routing matrix in all 30 boundary cases. The Durable Queue completed 100 events without duplicate tasks, new failed tasks, or unintended firewall rules. An eight-alert contention experiment preserved the configured limit of one active model request, and 30 sequential measurements showed an overall mean post-alert processing time of approximately 33 seconds. The results demonstrate functional correctness, traceability, controlled recovery, and bounded model integration within the evaluated laboratory scope.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.26316