How we built it: Alert Similarity

**Executive summary:** Expel developed an "Alert Similarity" system that transforms security alerts into MinHash vector embeddings, uses Pinecone for sub-second vector search to find similar alerts, and surfaces Alert Suggestions to SOC analysts; the team validated the approach on ~40,000 alerts (finding ~5–6% had similar neighbors), instrumented rollout with LaunchDarkly and Datadog to measure accuracy and analyst time savings, and emphasized communication, production data, and measurable metrics as keys to successful deployment.