Security analysts have specialized skills in short supply. We will discuss what AI models can (and can’t) do to assist in incident investigation and response, complementing seasoned pros and how to build, train and evaluate models to: identify artifacts related to an incident, correlate incidents into multi-stage cyberattacks, classify those attacks, and even provide recipes to remediate.