# AI-Driven Security Alert Screening and Alert Fatigue Mitigation in Security Operations Centers: A Survey

arXiv: https://arxiv.org/abs/2605.08316 · HTML: https://mlsanity.com/paper/2605.08316/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 May 2026.

## Built on by (most cited first, 1 of 1)

- [REFINE: A Resilient Evolution Framework for Intelligent Enterprise Alert Triage in Security Operations Centers](https://mlsanity.com/paper/2609.32516/) (2026)

## Abstract (arXiv)

Security alert screening is the downstream task of filtering, prioritizing, correlating, and contextualizing alerts for analyst attention in Security Operations Centers. This survey reviews artificial-intelligence-driven alert screening and alert-fatigue mitigation from 2015 to 2026. We synthesize 119 records, including 87 core studies, into a four-stage workflow taxonomy covering filtering, triage, correlation, and generative augmentation. We find persistent gaps in operational validation, adversarial robustness, cross-environment generalization, and evaluation practice. The survey concludes with a research agenda toward trustworthy Cognitive Security Operations Centers.