You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: blog-cse/2025-11-21-application.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,28 +9,28 @@ hide_table_of_contents: true
9
9
10
10
import useBaseUrl from '@docusaurus/useBaseUrl';
11
11
12
-
### AI tools for insight investigation (Beta)
12
+
### SOC Analyst Agent (Beta)
13
13
14
-
We're excited to announce two new AI tools to assist in your Security Operation Center (SOC) team's investigation of Cloud SIEM insights:
15
-
* SOC Analyst Agent
16
-
* Investigation Agent
14
+
We're excited to announce Sumo Logic's SOC Analyst Agent, a powerful agentic AI tool designed to improve the speed and accuracy of your Security Operation Center (SOC) team's threat investigations.
17
15
18
-
These powerful AI tools are designed to improve the speed and accuracy of your SOC team's threat investigations.
16
+
The SOC Analyst Agent provides the following new functionality:
17
+
* AI Investigation tab in Cloud SIEM
18
+
* Insight investigation in Mobot
19
19
20
-
#### SOC Analyst Agent
20
+
#### AI Investigation tab
21
21
22
-
A new **AI Investigation** tab in Cloud SIEM provides an AI-generated analysis of insights that accelerates investigation and troubleshooting by your SOC team. The information in the tab is generated by Sumo Logic's SOC Analyst Agent, an agentic AI tool.
22
+
A new **AI Investigation** tab in Cloud SIEM provides an AI-generated analysis of insights that accelerates investigation and troubleshooting by your SOC team.
When you select the **Ask Mobot** button on the new **AI Investigation** tab in Cloud SIEM, the insight's AI-generated information is launched in Sumo Logic Mobot. There you can use Sumo Logic's Investigation Agent to drill down into the insight for greater detail.
28
+
When you select the **Ask Mobot** button on the new **AI Investigation** tab in Cloud SIEM, the insight's AI-generated information is launched in Sumo Logic Mobot. There you can use Mobot's focused query capabilities to drill down into the insight for greater detail.
This new functionality is available for participants in our beta program. To request access, contact your Sumo Logic account representative or Support.
Copy file name to clipboardExpand all lines: docs/cse/get-started-with-cloud-siem/soc-analyst-agent.md
+17-12Lines changed: 17 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,8 +1,8 @@
1
1
---
2
-
id: ai-investigation-of-insights
3
-
title: AI Investigation of Insights
4
-
sidebar_label: AI Investigation of Insights
5
-
description: Learn how to perform investigations of a Cloud SIEM insights assisted by Sumo Logic artificial intelligence tools.
2
+
id: soc-analyst-agent
3
+
title: SOC Analyst Agent
4
+
sidebar_label: SOC Analyst Agent
5
+
description: Learn how to use Sumo Logic's SOC Analyst Agent to perform investigations of Cloud SIEM insights.
6
6
---
7
7
8
8
<head>
@@ -13,15 +13,20 @@ description: Learn how to perform investigations of a Cloud SIEM insights assist
13
13
14
14
import useBaseUrl from '@docusaurus/useBaseUrl';
15
15
16
-
The **AI Investigation** tab in the details page of a Cloud SIEM insight is an artificial intelligence-generated analysis of the insight that accelerates investigation and troubleshooting by your Security Operations Center (SOC) team. The information in the tab is generated by Sumo Logic's SOC Analyst Agent, an agentic AI tool.
16
+
Sumo Logic's SOC Analyst Agent is an agentic AI tool designed to improve the speed and accuracy of your Security Operation Center (SOC) team's threat investigations.
17
17
18
18
The SOC Analyst Agent performs two distinct jobs that mirror an analyst’s daily responsibilities:
19
19
***Triage**. Delivers automated verdicts on insights using evidence-backed
20
20
reasoning to determine whether the insights are malicious, suspicious, or benign.
21
-
***Investigation**. Supports analysts with a hypothesis-driven approach to assess
22
-
the scope, context, and likely impact of an event.
21
+
***Investigation**. Supports analysts with a hypothesis-driven approach to assess the scope, context, and likely impact of an event.
23
22
24
-
## View the AI Investigation tab
23
+
The SOC Analyst Agent provides the following functionality:
24
+
*[AI Investigation tab in Cloud SIEM](#ai-investigation-tab)
25
+
*[Insight investigation in Mobot](#investigate-the-insight-in-mobot)
26
+
27
+
## AI Investigation tab
28
+
29
+
The **AI Investigation** tab in the details page of a Cloud SIEM insight is an artificial intelligence-generated analysis of the insight.
25
30
26
31
1.[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM > Insights**. You can also click **Go To...** at the top of the screen and select **Insights**. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main menu select **Cloud SIEM** and then click **Insights** at the top of the screen.
27
32
1. On the insights list page, select an insight.
@@ -52,10 +57,10 @@ Click in the **Filters** area near the top of the insights page and select **AI
52
57
## Investigate the insight in Mobot
53
58
54
59
1. From the insight's details page, click **Ask Mobot** to open the AI investigation in [Sumo Logic Mobot](/docs/search/mobot/).<br/><img src={useBaseUrl('img/cse/ask-mobot-buttons.png')} alt="Ask Mobot buttons" style={{border: '1px solid gray'}} width="800" />
55
-
1. Details about the AI investigation appear in the Sumo Logic Investigation Agent, an AI agentic tool. The entire context of the AI investigation is brought into Mobot so you can quickly drill down for more information about the insight.<br/><img src={useBaseUrl('img/cse/insight-agent-in-mobot.png')} alt="Mobot Investigation Agent" style={{border: '1px solid gray'}} width="600" />
56
-
1. In **Ask Something...**, type a question about the insight using details provided in the **What Happened** section above. For example, you could ask to see logs about the entities mentioned in the text (that is, hosts, users, IP addresses, file hashes, and so on).<br/><img src={useBaseUrl('img/cse/investigation-agent-query.png')} alt="Investigation Agent query" style={{border: '1px solid gray'}} width="600" />
57
-
1. Click **Search** <img src={useBaseUrl('img/cse/search-button-in-mobot.png')} alt="Search button in Mobot" width="30" />. The Investigation Agrent analyzes your request and fashions a query based on it.
58
-
1. Click **View Results** to see the results of your request in the logs query UI. You can also click the suggestions provided to drill down farther. As you ask questions, Mobot retains the context of your conversation about the insight, allowing you to more easily obtain detail. <br/><img src={useBaseUrl('img/cse/investigation-agent-results.png')} alt="Investigation Agent query results" style={{border: '1px solid gray'}} width="600" />
60
+
1. Details about the AI investigation appear in Mobot. The entire context of the AI investigation is brought into Mobot so you can quickly drill down for more information about the insight.<br/><img src={useBaseUrl('img/cse/insight-agent-in-mobot.png')} alt="Mobot investigation" style={{border: '1px solid gray'}} width="600" />
61
+
1. In **Ask Something...**, type a question about the insight using details provided in the **What Happened** section above. For example, you could ask to see logs about the entities mentioned in the text (that is, hosts, users, IP addresses, file hashes, and so on).<br/><img src={useBaseUrl('img/cse/investigation-agent-query.png')} alt="Insight nvestigation query" style={{border: '1px solid gray'}} width="600" />
62
+
1. Click **Search** <img src={useBaseUrl('img/cse/search-button-in-mobot.png')} alt="Search button in Mobot" width="30" />. Mobot analyzes your request and fashions a query based on it.
63
+
1. Click **View Results** to see the results of your request in the logs query UI. You can also click the suggestions provided to drill down farther. As you ask questions, Mobot retains the context of your conversation about the insight, allowing you to more easily obtain detail. <br/><img src={useBaseUrl('img/cse/investigation-agent-results.png')} alt="Insight investigation query results" style={{border: '1px solid gray'}} width="600" />
0 commit comments