Security information and event management (SIEM) triage action analysis feedback system

A computer-implemented system for analyzing Security Information and Event Management (SIEM) triage actions, comprising:

• an interface configured to receive one or more interactions from an analyst through an interactive user interface or an application programming interface (API);
• a database configured to store action logs wherein each action log comprises metadata associated with an interaction and a case state information;
• and
• an analytic platform comprising a computer processor coupled to the interface and the database and further configured to perform the steps of:
• receiving one or more analyst interactions with at least one SIEM component;
• extracting case state information before and after each analyst interaction;
• storing one or more action logs in the database, wherein each action log comprises metadata associated with the one or more analyst interactions and the extracted case state information;
• automatically analyzing, using a wrapper component, the one or more action logs to identify patterns in analyst behavior and one or more case characteristics, wherein the wrapper component is configured to intercept analyst interactions with the at least one SIEM component by implementing system hooks that transparently capture interaction data without disrupting analyst workflows;
• generating a notification based on the identified patterns;
• and
• automatically updating parameters of a SIEM case generation process based on the identified patterns, wherein the updating comprises applying deprioritization logic that suppresses case generation based on the identified patterns and dynamically adjusts case creation parameters.