How we built this: machine learning, IAM, and ITDR with Expel’s SOC

**Executive Summary:** Expel describes an AI-powered identity alert classification engine that triages identity-based alerts (Malicious, Suspicious, Likely benign, Benign, Inconclusive) using XGBoost ensembles, surfaces the top evidence driving each decision for analyst transparency, and applies smart auto-closure with continuous quality control and safety guardrails to reduce analyst workload and improve SOC efficiency.