Authors - Majed Rahman, Mashrur Wasek, Faisal Quader Abstract - A typical Security Operations Center (SOC) receives 500– 10,000 alerts a day, 80–95% of them false alarms, but a Tier 1 analyst can only meaningfully look at 20–30 in a shift. We present Tier 0 SOC Agent, an AI layer that triages every alert before a human sees it. For each alert, the agent runs a four-phase loop (plan, investigate, decide, explain) over a Model Context Protocol (MCP) ecosystem of 45 tools across ten data sources, and returns a structured verdict with a confidence score, MITRE ATT&CK techniques, and the evidence behind the call. A multi-factor scorer combining source reliability, evidence diversity, and severity routes each alert to one of four tiers: auto-close, T1 with a pre-written summary, T2, or T3. In a four-day production deployment across two customer tenants and 27 Wazuh agents, the agent triaged 93 alerts in a mean of 118 s each, roughly an order of magnitude faster than a human, with zero runtime failures and a 64% drop in tool calls per alert versus the previous generation. A safety scaffold of five downgrade-only policy rules, a circuit breaker, a file-based killswitch, and a read-only tool filter guarantees the agent cannot auto-close any alert beyond what its verdict and the policy jointly authorize.
