SIEM Alert Narrator

SIEM Alert Narrator does the part of SOC triage that burns an analyst's morning: taking a wall of alerts and working out which handful actually represent something. It normalises alerts from your SIEM, maps their severities onto a common scale, groups them by signature and source so the same thing firing forty times becomes one item with a count, suppresses the flapping and the known noise, and scores what remains by priority. Then it writes the read an analyst would write — what happened, why it matters, what to check next. The split is strict. Every count, severity and source is code-derived. The language model writes the narrative and only the narrative; it never produces a number and never asserts a definitive cause, because a confident wrong attribution in a security context sends people down the wrong path for hours. With no model available it falls back to a template and the triage is unchanged. Read-only is structural, not a setting. The connector issues GET requests only — there is no mute, no close, no action endpoint anywhere in the code. It cannot acknowledge an alert, and it cannot make one disappear. Alert text is defanged for prompt injection before it reaches the model, network access is restricted to your SIEM host alone, and sources and personal data are masked. If there are no alerts, the triage comes back empty rather than inventing something to report. Each stage is callable alone: `normalize_alerts` to clean a batch, `correlate_and_triage` to group and score alerts you already have, `narrate_findings` to write the summary for groups you triaged yourself. It connects to Datadog or a generic read API with a credential, or runs on alerts you paste in with no setup at all. Built for SOC and SecOps teams drowning in alert volume.