What An Agentic Investigation Looks Like

In this post, I will show you what an agentic investigation looks like.

Detection, the act of identifying potential security incidents or anomalies, has been a major focus for security teams over the years. But detection is only part of the solution; it’s investigation that ultimately stops threats.

Investigation is the subsequent process of analyzing the detected incident to determine its scope, root cause, and the necessary response. With every alarm, there is a question: Is something wrong?

Agentic investigation flips this model on its head. Instead of waiting on a human to start an investigation, an agentic investigative system, powered by AI SOC Agents, starts as soon as an alarm is sounded. This means an investigation is complete within minutes, including evidence collection and correlation across systems.

This is a fundamental change to how a security operations center works. And that changes everything for an organization’s security posture.

Why Traditional Alert Investigation Creates Backlogs

According to Prophet Security, a leading provider of AI SOC solutions, most SOCs face the same constraint: time.

An alert joins the queue, and the analyst opens it and starts gathering context, such as querying identity logs, reviewing endpoint activity, reviewing authentication history, reviewing cloud access patterns, and so on. Each piece of context requires a separate query, tool, or dashboard. Each investigation can take 30 minutes or more on its own.

When the rate at which alerts are received exceeds the rate at which they can be investigated, prioritization is required. In this case, the higher-priority alerts are addressed first, and lower-priority alerts are left for hours or days or are never investigated at all.

Agentic investigation eliminates this constraint.

The Start Of An Agentic Investigation

An agentic investigation begins when the alert is raised.

Let’s look at a familiar case: a suspicious login: An identity system raises an alert because a user has logged in from a suspicious location or time, such as someone logging in from Sydney at 2:00 AM local time when they normally log in from New York during working hours.

In a traditional workflow, the alert is simply added to the queue. In an agentic workflow, the investigation starts instantly. No human intervention is needed, and the system starts gathering evidence from all available sources.

Step-By-Step: What The Agent Does

The process of investigating follows a predefined pattern. Instead of asking the analyst to manually collect the evidence, the agent performs the whole process automatically.

1. Identity Context

The system first checks the identity-related activity:

• Authentication history for the user
• MFA status: Success or failure
• Previous login locations
• Risk indicators from the identity providers

It quickly identifies whether the pattern of the login is abnormal for the specific user.

2. Endpoint Telemetry

In the next step, the agent checks the device that is being used in the login process:

• Endpoint security logs
• Device health signals
• Process activity on the endpoint in the past few minutes
• Malware signals on the endpoint

This step checks if the login is from a trusted device or a potentially compromised endpoint.

3. Cloud Access Patterns

In the final step, the system checks what happened after the login:

• Applications accessed during the session
• API and cloud resource access signals
• Anomalous download or data access patterns

This checks if there is anything suspicious after the login.

4. Peer Behavior Baselines

To rule out false positives, the agent will look at how this compares to other similar users:

• Typical login patterns for the user’s department
• Normal travel patterns within the organization
• Role-based access patterns

This type of analysis will help to identify whether a particular activity is an anomaly or a legitimate one, such as traveling or working different hours.

5. Correlated Signals

Lastly, the agent will look at correlated signals that may indicate a higher or lower probability of compromise.

Some of these include:

• Email forwarding rule creations
• File permission changes
• Privilege escalations
• Lateral movement
• Suspicious file accesses

These signals are correlated into a single narrative.

A Complete Investigation In Minutes

After collecting the evidence, the system will then analyze the signals and determine what it believes will be the outcome. Within a few minutes, the threat has been classified into one of two categories:

Malicious activity confirmed: The investigation has supplied a complete chain of evidence on what led to the compromise.

Benign activity explained: The system has identified the reason behind the alarm, such as confirmed travel or normal behavioral variation.

Rather than presenting analysts with an uninterpreted alarm, they get a complete investigation.

The Time Difference Is Dramatic

This automation causes a measurable change. 

In a traditional SOC: Median investigation time: 

• 30 minutes or more per alert
• Only a portion of alerts are investigated

In an agentic SOC:

• Median investigation time: less than five minutes
• All alerts are investigated

Every single one of those alerts is investigated with the same level of scrutiny. This eliminates blind spots that attackers often exploit against us.

Changing The Role Of The Analyst

Perhaps one of the most surprising effects of agentic investigation is how it transforms the analyst’s role.  Traditionally, much of an analyst’s time is spent gathering data, which can include tasks such as query execution, log collection, activity correlation, and documentation.

However, an agentic system can perform all of these tasks automatically.

The focus for an analyst is then on something that people do best: judgment and decision-making. Once an investigation is complete, they can review the results and make a decision on how to proceed. Possible actions could include blocking an account, isolating a device, escalating an incident, and even conducting a threat hunt.

In essence, a SOC analyst is no longer just a data collector but a decision-maker. For a seasoned security professional, this can be a profound change.

The Impact On SOC Structure

Agentic investigation also impacts the structure of SOC teams.

Traditional SOCs have a tiered structure where:

• Tier 1 analysts handle the triage of the investigation
• Tier 2 analysts conduct deeper investigations
• Tier 3 analysts handle deeper investigations of the cases

However, when the investigation is fully documented and evidence-based, the scenario changes.

The junior analysts can look at the investigation, verify the results, and take action without the need to escalate the investigation.

This reduces the need to rely on Tier 2 and Tier 3 analysts during investigations, making the SOC structure flatter and more efficient.

Senior analysts can focus on complex threats and incident response, spending less time reviewing investigations that have not been completed.

A Hidden Benefit: Analyst Retention

However, there is another, equally significant outcome.

Many SOC analysts leave their roles due to repetition and fatigue. Processing hundreds of investigations manually each week can feel more like data processing than security analysis. Agentic investigation eliminates a great deal of this work.

This can make the role more interesting and more closely aligned with the skills and experience that professionals can bring to a security role.

For SOC managers facing a staffing crisis and burnout, this can be a significant factor.

The Bigger Change Security Teams Should Consider

Agentic investigation is not yet one more automation feature; it’s a change in philosophy for how a SOC operates.

Rather than having analysts collect evidence manually, businesses can create a workflow where investigations start automatically, and evidence is collected before a person ever even sees an alert.

This creates a different question for security teams to answer: What would your SOC look like if every single one of those investigations were done immediately?

When investigations become continuous instead of a backlog, security teams can cover more ground, and analysts can spend more time making decisions instead of collecting data. In modern security operations, that change in philosophy may be the single most valuable change of all.

INTERESTING POSTS

About the Author:

Kirsten Doyle

Cybersecurity Contributor at Bora Design S.R.L |  + postsBio

Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications. She is also a regular writer at Bora.