OpenText launches AI Bridge to automate SIEM alert triage and SOC queries

OpenText introduced the SIEM AI Bridge, a component that links its Enterprise Security Manager (ESM) with large‑language models. Analysts can ask plain‑English questions such as “show me failed logins for this IP” and receive correlated, summarized results without writing complex SIEM queries. The bridge works with cloud‑based or on‑prem LLMs—including Claude, Gemini, OpenAI and Ollama—so sensitive security data can stay inside an organization’s network.

A separate implementation shows how a Python pipeline can pull raw SIEM alerts, enrich them with user, asset and threat‑intel context, and pass the enriched payload to an LLM for first‑pass triage. The approach claims to cut alert noise by up to 80 % and produce structured triage reports that feed directly into ticketing systems, helping analysts focus on the most critical incidents.