Existing host intrusion detection systems typically utilize deep learning techniques to detect network attack behaviors from large volumes of log data and generate alerts. However, these methods often fail to balance usability and accuracy, as the generated alerts typically only include the alert type and its mapping to raw logs. This information is insufficient for subsequent processing and response tasks, and accurate diagnosis still requires substantial manual effort to determine the specific causes. To enhance the utility of detection alerts, this study proposes a novel alert analysis method, \(\mathbf {A^3LLM}\) , based on Large Language Model (LLM) technology. The method fine-tunes a smaller model through supervision and applies GRPO-based reinforcement learning to optimize the model’s reasoning outputs. The proposed method builds reasoning from raw logs to alert logs, determining the attack alert and providing explanations of the causes of alerts. Experimental validation on public datasets shows significant improvements in the quality of generated content after reinforcement learning, and the proposed method outperforms state-of-the-art general LLMs in the accuracy of alert authenticity judgment.