How would you design an AI-powered SIEM using ML?

Architecture layers: (1) Data ingestion — normalise logs from firewalls, endpoints, cloud (Splunk/Elastic). (2) Feature engineering — time windows, behavioural profiles per user/host, statistical aggregations. (3) Model layer — three approaches: (a) supervised classifiers for known attack patterns (XGBoost on labelled incidents), (b) unsupervised anomaly detection (isolation forest, autoencoders) for novel threats, (c) sequence models (LSTMs/transformers) for multi-stage attack detection. (4) Alert layer — confidence-scored alerts with explainability (SHAP values). (5) Feedback loop — analyst feedback retrains model, reduces false positives over time. Production tools: Splunk MLTK, Microsoft Sentinel UEBA, Darktrace, Vectra.