As a blue team on the defense side, we approach cybersecurity with different perspectives compared to the red team. Our considerations go beyond accuracy in handling large-scale data; we also prioritize compliance with government cybersecurity regulations, response time, and cost-effectiveness. Throughout our journey, our team has extensively researched using Machine Learning automation in the investigation of large-scale cybersecurity incidents. We have integrated AI into various analytical aspects, from endpoint event correlation and Cmdline analysis using CmdGPT to an AI virtual analyst that automatically generates forensic reports.  Starting last year, we introduced a new generation of large-scale language models into our blue team AI assistant, enabling automated cybersecurity incident handling and case management. In this presentation, we will share our practical experiences and exclusive insights on how cybersecurity teams can leverage AI effectively, along with showcasing real-life case studies.  作為防禦方的藍隊有許多與紅隊切入角度不同的思維，不但需要考慮到大規模資料量下的準確度，為了符合政府的資安規範，也更加注重反應時間與成本。一直以來，我們團隊對於大規模的資安事件，在調查中使用 Machine learning 自動化方法做了許多研究，將 AI 導入到各個分析面向，從端點事件關聯、分析 Cmdline 的 CmdGPT，以及 AI 虛擬分析師自動產生鑑識報告，而到去年開始，我們為藍隊 AI 助手導入了新一代的大型語言模型，以進行自動資安事件處理與自動案件管理。這場演講中，將透過我們的實務經驗，獨家分享資安團隊該如何正確使用 AI，並分享實際的案例。