Integrating Large Language Models with IDS for Analyst-Guided Automated Threat Response

The increasing sophistication and volume of cyberattacks demand intrusion detection systems (IDS) that combine speed, accuracy, and operational trust. To address this, we present a hybrid detection and response system combining IDS with GPT to improve threat detection, investigation, and response, ultimately lowering Mean Time to Respond (MTTR). Suricata IDS is integrated with GPT in a virtualised environment, continuously monitoring network traffic and generating alerts for suspicious activities. GPT classifies alerts as Low, Medium, High, or Critical based on intelligence. The system automatically queues a recommended response action, such as IP blocking, port filtering, or service shutdown, into a human-in-the-loop approval panel for medium and high-severity alerts. Approved actions are enforced using a host-based firewall (ufw), with automatic rollback after a configurable duration. The architecture incorporates Slack notifications for rapid analyst engagement and ensures auditability through a persistent state store. Experimental testing demonstrates reduced response latency and improved triage accuracy. This method combines AI-driven analysis with SOC procedures to provide a trustworthy automated cyber defence solution.