Analyze log files or other digital information to identify the perpetrators of network intrusions.
Analyze log files or other digital information to identify the perpetrators of network intrusions.
Task automation exposure
Low exposure
Exposure basis
[v4/median] score 35 (raw 35 | A 45 / B 35 / C 35 | modality: other) AI tools can rapidly parse and correlate massive log datasets to flag anomalies and potential attack vectors, but they lack the contextual reasoning and investigative judgment required to definitively attribute actions to specific human perpetrators without significant human over (capable: SIEM with AI/ML integration (e.g., Splunk, Microsoft Sentinel))
0 capabilities · 1 occupations
Basis
How exposure was assessed
[v4/median] score 35 (raw 35 | A 45 / B 35 / C 35 | modality: other) AI tools can rapidly parse and correlate massive log datasets to flag anomalies and potential attack vectors, but they lack the contextual reasoning and investigative judgment required to definitively attribute actions to specific human perpetrators without significant human over (capable: SIEM with AI/ML integration (e.g., Splunk, Microsoft Sentinel))
How much of this task's output current AI can produce or substantially assist.
Best current model strength on any capability this task requires.
This is an assessment of technical feasibility plus published evidence - not a forecast. Even fully automatable tasks are often not automated, because of cost, verification, liability, regulation or the fact that the task is bundled with other work.
Occupations
Occupations that perform this task (1)
Importance is the O*NET-style weight of this task within each occupation. The same task can be highly exposed but peripheral to one job and core to another.
| Occupation | Industry | Importance | Role | Occupation AI exposure |
|---|---|---|---|---|
| Digital Forensics Analysts | Cross-industry | 3.7/5 | core | 10 |
Evidence
Evidence (0)
No evidence item is mapped to this specific task yet. The exposure figure above rests on the v1 editorial baseline and on the capability assessment, and should be treated as low-confidence. Pages with fewer than 0 evidence items are excluded from sitemaps.