You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: blog-cse/2025-11-21-application.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,23 +9,23 @@ hide_table_of_contents: true
9
9
10
10
import useBaseUrl from '@docusaurus/useBaseUrl';
11
11
12
-
### AI tools for insight investigation (beta)
12
+
### AI tools for insight investigation (Beta)
13
13
14
-
We're excited to announce two new powerful AI capabilities to assist in your Security Operation Center (SOC) team's investigation of Cloud SIEM insights:
15
-
* SOC Analyst Agent in Cloud SIEM
16
-
* Investigation Agent in Mobot
14
+
We're excited to announce two new AI tools to assist in your Security Operation Center (SOC) team's investigation of Cloud SIEM insights:
15
+
* SOC Analyst Agent
16
+
* Investigation Agent
17
17
18
-
These powerful AI tools will improve the speed and accuracy of your SOC team to investigate threats.
18
+
These powerful AI tools are designed to improve the speed and accuracy of your SOC team's threat investigations.
19
19
20
20
#### SOC Analyst Agent
21
21
22
22
A new **AI Investigation** tab in Cloud SIEM provides an AI-generated analysis of insights that accelerates investigation and troubleshooting by your SOC team. The information in the tab is generated by Sumo Logic's SOC Analyst Agent, an agentic AI tool.
When you select the **Ask Mobot** button on the new **AI Investigation** tab, the insight's AI-generated information is launched in Sumo Logic Mobot. There you can use the Sumo Logic Investigation Agent to drill down into the insight for greater detail.
28
+
When you select the **Ask Mobot** button on the new **AI Investigation** tab in Cloud SIEM, the insight's AI-generated information is launched in Sumo Logic Mobot. There you can use Sumo Logic's Investigation Agent to drill down into the insight for greater detail.
Copy file name to clipboardExpand all lines: docs/cse/get-started-with-cloud-siem/ai-investigation-of-insights.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ description: Learn how to perform investigations of a Cloud SIEM insights assist
13
13
14
14
import useBaseUrl from '@docusaurus/useBaseUrl';
15
15
16
-
The **AI Investigation** tab in the details page of a Cloud SIEM insight is an AI-generated analysis of the insight that accelerates investigation and troubleshooting by your Security Operations Center (SOC) team. The information in the tab is generated by Sumo Logic's SOC Analyst Agent, an agentic AI tool.
16
+
The **AI Investigation** tab in the details page of a Cloud SIEM insight is an artificial intelligence-generated analysis of the insight that accelerates investigation and troubleshooting by your Security Operations Center (SOC) team. The information in the tab is generated by Sumo Logic's SOC Analyst Agent, an agentic AI tool.
17
17
18
18
The SOC Analyst Agent performs two distinct jobs that mirror an analyst’s daily responsibilities:
19
19
***Triage**. Delivers automated verdicts on insights using evidence-backed
@@ -24,8 +24,8 @@ the scope, context, and likely impact of an event.
24
24
## View the AI Investigation tab
25
25
26
26
1.[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM > Insights**. You can also click **Go To...** at the top of the screen and select **Insights**. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main menu select **Cloud SIEM** and then click **Insights** at the top of the screen.
27
-
1. On the insights list page, click an insight.
28
-
1. The insight details are displayed. The **AI Investigation** tab for the insight shows the results of the AI analysis:<br/><img src={useBaseUrl('img/cse/insight-ai-investigation-tab.png')} alt="Insight AI Investigation tab" style={{border: '1px solid gray'}} width="800" />
27
+
1. On the insights list page, select an insight.
28
+
1. The **AI Investigation** tab shows results of AI analysis:<br/><img src={useBaseUrl('img/cse/insight-ai-investigation-tab.png')} alt="Insight AI Investigation tab" style={{border: '1px solid gray'}} width="800" />
29
29
1.**Severity Verdict**. Details about the insight's severity analysis:
30
30
***Current Severity**. The severity of the insight as set by the cumulative activity score for the insight. For more information, see [About insight severity](/docs/cse/get-started-with-cloud-siem/insight-generation-process/#about-insight-severity).
31
31
***Global Confidence Score**. A level of confidence that the insight is actionable, predicted by Sumo Logic’s Global Intelligence machine learning model. See [What is a Global Confidence score?](/docs/cse/records-signals-entities-insights/global-intelligence-security-insights/#what-is-a-global-confidence-score).
@@ -41,7 +41,7 @@ the scope, context, and likely impact of an event.
41
41
Help us refine the tool by using the thumbs-up or thumbs-down buttons to provide feedback on the effectiveness of the summary presented. Clicking the thumbs-down button gives you the opportunity to provide additional feedback.
42
42
:::
43
43
1.**Key Findings**. The main points uncovered by AI analysis. Details about these findings can be found in the signals that fired for the insight.
44
-
1.**Ask Mobot**. Click to send the AI analysis of the insight to Sumo Logic Mobot for further investigation.
44
+
1.**Ask Mobot**. Click to send the AI analysis of the insight to [Sumo Logic Mobot](#investigate-the-insight-in-mobot) for further investigation.
45
45
46
46
### Filter for AI verdicts
47
47
@@ -81,7 +81,7 @@ Unlike traditional correlation logic, which is static, the SOC Analyst Agent app
81
81
82
82
### What data does the agent rely on to render verdicts?
83
83
84
-
The agent draws from normalized security data (`sec_record*` indexes and signals), correlated entities, Sumo Logic’s integrated threat intelligence feeds, and enrichment data (for example, geo-IP, user behavior, asset details).
84
+
The agent draws from normalized security data (`sec_record*` indexes and signals), correlated entities, Sumo Logic’s integrated threat intelligence feeds, and enrichment data (for example, IP geolocation, user behavior, and asset details).
85
85
86
86
### Can analysts provide feedback or correct AI verdicts?
0 commit comments