Summary

  • FIRST schedules CEDIA SOC-CSIRT’s Freddy Gómez to describe DALIA, a multi-agent AI architecture for CSIRT triage, correlation and prioritization, on 21 October alongside LACNIC 46.
  • The abstract says people retain critical decisions and containment. It supplies no permissions, error rates or incident outcomes; the session has not yet taken place.

The control boundary is the news

The FIRST Regional Symposium will meet in Mendoza on 21–22 October, alongside LACNIC 46 and LACNOG 2026. FIRST says the event is hybrid and co-hosted by LACNIC and CERT.br/NIC.br. Its programme schedules Freddy Gómez of CEDIA SOC-CSIRT for 11:30–12:05 on 21 October. The session is titled “From Signals to Containment” and is marked TLP:CLEAR.

The abstract describes DALIA as a multi-agent AI architecture intended to support incident-response triage, signal correlation and prioritization. It says a case drawn from operations will show how signals from different sources can reduce uncertainty. Its stated boundary is equally clear: AI supports analysis and prioritization; people remain responsible for critical decisions and containment actions.

That statement is more specific than a general claim about AI agents, but it is still a programme abstract. It gives no agent permissions, escalation thresholds, false-positive rate, time-to-triage measure or case outcome. The anonymized case has not yet been presented, so the agenda is evidence of what the speaker plans to discuss, not proof of a deployed design or measured result.

The distinction matters because a January ITahora profile, quoting CEDIA information-security manager Jorge Merchán, described DALIA as an automated external-attack-surface project with ticket traceability, alerts and real-time metrics across more than 80 higher-education institutions. The profile also referred to automated incident containment. That is an attributed project description, not independent performance validation.

The two descriptions need not conflict: routine monitoring or pre-authorized responses can be automated while consequential containment remains a human decision. But the public material does not define those action classes. LACNIC’s CSIRT helped build the regional symposium, which brings response teams and network operators together; the relevant test in Mendoza is whether the presentation makes the authority boundary operationally visible.

Sources

FIRST programme and session abstract; FIRST event details; LACNIC’s symposium preview; ITahora’s January profile of DALIA.