Enhancing Government Cybersecurity through the Utilization of Automated and AI-Driven Techniques to Fortify Security Information and Event Management (SIEM) Systems

Abstract

Security Information and Event Management (SIEM) systems are a key part of modern cybersecurity operations, especially in government settings where they are responsible for protecting sensitive data and making sure that important national services keep running. Even though traditional SIEM platforms are used a lot, they mostly use rule-based detection methods and manual incident response workflows. This makes it take longer to contain threats and keeps the false positive rate high. This paper systematically analyzes the operational difficulties encountered during SIEM implementations at the General Administration of Government Computer (GAGC) and the Palestinian Computer Emergency Response Team (PALCERT), both functioning under the Ministry of Telecommunications and Information Technology in Palestine. A mixed-methods research methodology—incorporating semi-structured expert interviews, focus group discussions, structured surveys, and quantitative log analysis—is utilized to assess current operational constraints and system limitations. Based on these results, we suggest a better AI-driven SIEM framework that combines machine learning-based threat detection with an automated incident response layer that follows security playbooks that have already been set up. Experimental assessment utilizing simulated cyberattack scenarios indicates statistically significant enhancements: detection accuracy rose from 79.1% to 91.5%, the false positive rate diminished from 32.4% to 20.2%, and the average incident response time decreased from 18.7 to 11.0 minutes, reflecting a 41% reduction. These results show that adding AI and automation to SIEM operations can make national cybersecurity much stronger, make analysts less tired, and make government digital infrastructure more resilient overall.