SIEM Workflow Optimization and Threat Intelligence for Cloud Incident Response: Approaches to Correlation Automation, Triage Reduction, and Cloud Infrastructure Resilience
Year: 2026
Type: article
Study design: Systematic Review
Abstract: Cloud infrastructure faces a growing volume of security events that legacy rule-based Security Information and Event Management (SIEM) systems struggle to process in time for effective incident response. According to the IBM Cost of a Data Breach Report 2024, the global average breach cost reached USD 4.88 million, with multi-cloud environments accounting for 40 percent of affected organizations and breach lifecycles averaging 258 days. This article examines approaches to SIEM workflow optimization in cloud environments, with a focus on automated correlation, behavior-based anomaly scoring, and threat intelligence integration as means to reduce incident triage time and improve response quality. The methodology combines a systematic literature review of peer-reviewed publications from 2019 to 2025, content analysis of industry benchmark reports, and synthesis of practical engineering experience from cloud data security initiatives. Results show that ML-augmented SIEM architectures can reduce triage time by 45 to 78 percent compared to manual processes, lower false-positive rates significantly, and support automated containment of priority-one incidents. The study proposes an integrated model linking Zero Trust access controls, Kubernetes audit logging, HashiCorp Vault secrets management, and MITRE ATT&CK-enriched correlation into a coherent cloud incident response architecture. The findings are relevant to cloud security engineers, security operations center analysts, and organizations building or modernizing security operations for critical cloud systems.
Author: Oblakevych, Kateryna
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7217517047