How it works
Decide which cases agents can handle and in which operating mode: only notify the customer, collaborate with them before acting, or act directly with prior authorization.
For each case, have an investigation agent gather the customer context, detections, indicators of compromise (IoCs) and relevant threat intelligence.
Use a planning model to build an investigation plan, carry out the steps and review the results in a plan–execute–review loop.
Ask for a final summary with the evidence and recommended response actions for an analyst to review.
Let other agents carry out only the parts of the response that fall within the limits your analysts set.
Send anything potentially destructive, or anything the agent isn't confident about, to a human.
Prompt
Replace anything in [brackets] with your own details.
You are the investigation agent for our SOC. For the case below, gather the customer context, the detections, the indicators of compromise and the related threat intelligence. Build an investigation plan, carry out each step and review what you found. Deliver: 1) a summary of what happened with the evidence, 2) the severity and your confidence level, 3) the recommended response actions, respecting the customer's mode (notify, collaborate or authorize). Don't take any destructive action: if one is needed or you're unsure, escalate the case to an analyst.Reported result
Average response time for cases using agents fell from about 38 minutes to 89 seconds (-96%), and 52% of MDR cases are now resolved end-to-end by AI, within limits calibrated by analysts (figures from OpenAI).
As reported by the source. Results depend on your setup and your data.