diff --git a/docs/cse/get-started-with-cloud-siem/soc-analyst-agent.md b/docs/cse/get-started-with-cloud-siem/soc-analyst-agent.md new file mode 100644 index 0000000000..563962f2ff --- /dev/null +++ b/docs/cse/get-started-with-cloud-siem/soc-analyst-agent.md @@ -0,0 +1,120 @@ +--- +id: soc-analyst-agent +title: SOC Analyst Agent +sidebar_label: SOC Analyst Agent +description: Learn how to use Sumo Logic's SOC Analyst Agent to perform investigations of Cloud SIEM insights. +--- + + + + + +

Beta

+ +import useBaseUrl from '@docusaurus/useBaseUrl'; + +Sumo Logic's SOC Analyst Agent is an agentic AI tool designed to improve the speed and accuracy of your Security Operations Center (SOC) team's threat investigations. + +The agent delivers automated verdicts on insights using evidence-backed reasoning to determine whether the insights are malicious, suspicious, or benign. It then provides a concise summary of threat incidents based on triggered signals in the insight. Finally, it presents key findings, including details found in the signals that fired for the insight. All of this results in quicker, more detailed analysis. + + + +## Filter for AI verdicts + +The SOC Analyst Agent runs in the background against all insights that flow into Cloud SIEM. After analysis, it renders a verdict about whether the insight requires investigation. + +1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM > Insights**. You can also click **Go To...** at the top of the screen and select **Insights**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main menu select **Cloud SIEM** and then click **Insights** at the top of the screen. +1. In the insight list page, note that the **AI Verdict** column shows the results of the AI analysis:
Insight AI Verdict column +1. Click **Start typing here to create a filter** near the top of the insights page and select **AI Verdict** to search for insights based on the verdict they are assigned: + * **Benign**. AI analysis determined that the insight is harmless and is not a candidate for elevation to SOC team investigation. + * **Inconclusive**. AI analysis could not determine whether the insight needs to be investigated. + * **In Progress**. AI analysis is in progress. + * **Malicious**. AI analysis determined that the insight is malicious, and warrants immediate investigation by your SOC team. + * **Suspicious**. AI analysis determined that the insight is suspicious and warrants investigation by your SOC team. +1. Clicking anywhere on the row of an insight that has an AI verdict shows a side panel with results of the verdict. This allows you to browse quickly for insights needing more investigation:
Insight AI side panel +1. To investigate an insight further, click the insight's ID. Insights with an AI verdict display an **AI Investigation** tab in the insight details page. Use the information on this tab to dive deeper into the insight. + +## AI Investigation tab + +The **AI Investigation** tab in the details page of a Cloud SIEM insight is an artificial intelligence-generated analysis of the insight. Use the information on this tab to guide your investigation. + +1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM > Insights**. You can also click **Go To...** at the top of the screen and select **Insights**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main menu select **Cloud SIEM** and then click **Insights** at the top of the screen. +1. On the insights list page, click an insight's ID. +1. The **AI Investigation** tab shows results of AI analysis:
Insight AI Investigation tab + 1. **Severity Verdict**. Details about the insight's severity analysis: + * **Current Severity**. The severity of the insight as set by the cumulative activity score for the insight. For more information, see [About insight severity](/docs/cse/get-started-with-cloud-siem/insight-generation-process/#about-insight-severity). + * **Global Confidence Score**. A level of confidence that the insight is actionable, predicted by Sumo Logic’s Global Intelligence machine learning model. See [What is a Global Confidence score?](/docs/cse/records-signals-entities-insights/global-intelligence-security-insights/#what-is-a-global-confidence-score). + * **AI Verdict**. The AI system's qualitative assessment of the insight. + * **Recommends security level of ___**. AI analysis recommends a new severity level be assigned to this insight. If you agree with the assessment, click **Accept**. The **Current Severity** field changes to the new value. + 1. **What Happened**. A concise summary of threat incidents based on triggered signals in the insight. Content of this field is generated by Sumo Logic's Summary Agent, an agentic AI tool. The summary consolidates key details to facilitate quick understanding and response by security teams. The summary is generated when an insight is created, and is regenerated whenever the insight is modified, keeping it current with added or removed signals. + :::tip + Help us refine the tool by using the thumbs-up or thumbs-down buttons to provide feedback on the effectiveness of the summary presented. Clicking the thumbs-down button gives you the opportunity to provide additional feedback. + ::: + 1. **Key Findings**. The main points uncovered by AI analysis. Details about these findings can be found in the signals that fired for the insight. + + + + + + +## FAQs + +### What is the Sumo Logic SOC Analyst Agent? + +The SOC Analyst Agent is part of the [Sumo Logic Dojo AI](/docs/get-started/ai-machine-learning/#whats-new-dojo-ai-for-the-soc). The SOC Analyst Agent is an assistant that applies agentic AI reasoning to triage and investigation tasks. It correlates alerts, weighs patterns against frameworks like MITRE ATT&CK, and renders evidence-backed verdicts, providing analysts an immediate sense of threat impact. + + +### What are the benefits of the agent? + +Security teams spend too much time validating false positives and performing repetitive investigative steps. By embedding reasoning and context-awareness directly into Cloud SIEM, the SOC Analyst Agent eliminates noise, standardizes outcomes, and accelerates time to resolution. + +### Will the agent increase scanning or data-processing costs? + +No. The agent analyzes existing data already ingested into Cloud SIEM. It performs reasoning on metadata and contextual signals rather than initiating new scans. + +### How does the agent differ from Cloud SIEM correlation or automation rules? + +Unlike traditional correlation logic, which is static, the SOC Analyst Agent applies agentic reasoning. It adapts based on insight context, recent analyst actions, and environmental signals, producing contextual, explainable decisions rather than fixed pattern matches. + +### What data does the agent rely on to render verdicts? + +The agent draws from normalized security data (`sec_record*` indexes and signals), correlated entities, Sumo Logic’s integrated threat intelligence feeds, and enrichment data (for example, IP geolocation, user behavior, and asset details). + +### Can analysts provide feedback or correct AI verdicts? + +Yes. Analysts can override verdicts and flag feedback within the UI. These actions are logged and reviewed to refine model behavior over time as part of the Dojo AI learning loop. + +## Additional resources + +* Blogs: + * [The SOC Analyst Agent: Bring an Agentic approach to work with your SOC team](https://www.sumologic.com/blog/soc-analyst-agent-for-soc-team) + * [Welcome to Dojo AI: Where AI agents strengthen your SOC](https://www.sumologic.com/blog/welcome-dojo-ai-agents-soc) + * [New agents in the Dojo: Expanded Sumo Logic Dojo AI](https://www.sumologic.com/blog/agents-dojo-ai-soc-analyst-mcp) +* Demos: + * [SOC Analyst Agent](https://www.sumologic.com/demo/soc-analyst-agent) + * [Mobot walkthrough](https://www.sumologic.com/demo/mobot-walkthrough) +* Sumo Logic website: [Dojo AI](https://www.sumologic.com/solutions/dojo-ai) \ No newline at end of file diff --git a/static/img/cse/ai-investigations-tab-in-release-note.png b/static/img/cse/ai-investigations-tab-in-release-note.png new file mode 100644 index 0000000000..add94b5c29 Binary files /dev/null and b/static/img/cse/ai-investigations-tab-in-release-note.png differ diff --git a/static/img/cse/ask-mobot-buttons.png b/static/img/cse/ask-mobot-buttons.png new file mode 100644 index 0000000000..e9ab7d5396 Binary files /dev/null and b/static/img/cse/ask-mobot-buttons.png differ diff --git a/static/img/cse/insight-agent-in-mobot.png b/static/img/cse/insight-agent-in-mobot.png new file mode 100644 index 0000000000..7fdbf7e311 Binary files /dev/null and b/static/img/cse/insight-agent-in-mobot.png differ diff --git a/static/img/cse/insight-ai-investigation-tab.png b/static/img/cse/insight-ai-investigation-tab.png new file mode 100644 index 0000000000..f62328277d Binary files /dev/null and b/static/img/cse/insight-ai-investigation-tab.png differ diff --git a/static/img/cse/insight-ai-verdict-column.png b/static/img/cse/insight-ai-verdict-column.png new file mode 100644 index 0000000000..38481e0457 Binary files /dev/null and b/static/img/cse/insight-ai-verdict-column.png differ diff --git a/static/img/cse/investigation-agent-query.png b/static/img/cse/investigation-agent-query.png new file mode 100644 index 0000000000..4eea8cf355 Binary files /dev/null and b/static/img/cse/investigation-agent-query.png differ diff --git a/static/img/cse/investigation-agent-results.png b/static/img/cse/investigation-agent-results.png new file mode 100644 index 0000000000..c1b1e92e47 Binary files /dev/null and b/static/img/cse/investigation-agent-results.png differ diff --git a/static/img/cse/search-button-in-mobot.png b/static/img/cse/search-button-in-mobot.png new file mode 100644 index 0000000000..9822a9f91c Binary files /dev/null and b/static/img/cse/search-button-in-mobot.png differ diff --git a/static/img/cse/soc-analyst-agent-side-panel.png b/static/img/cse/soc-analyst-agent-side-panel.png new file mode 100644 index 0000000000..ffc98da420 Binary files /dev/null and b/static/img/cse/soc-analyst-agent-side-panel.png differ