Sri Lankan Airlines’ network infrastructure is extensive, complex and accessed by thousands of users on a daily basis. When an incident occurs, the security team has to unnecessarily spend a substantial amount of time and resources to manually detect threats which include DDoS, ransomware, brute force, and phishing attacks. Additionally, this manual detection process takes time and it is challenging to differentiate between real threats and false positives. This leads to delays in threat analysis and remediation, thus not being able to satisfy compliance regulations.