|
1 | 1 | --- |
2 | | -id: ai-investigation-for-insights |
| 2 | +id: ai-investigation-of-insights |
3 | 3 | title: AI Investigation of Cloud SIEM Insights |
4 | 4 | sidebar_label: AI Investigation of Insights |
5 | 5 | description: Learn how to perform investigations of a Cloud SIEM insights assisted by Sumo Logic artificial intelligence tools. |
@@ -46,31 +46,31 @@ the scope, context, and likely impact of an event. |
46 | 46 |
|
47 | 47 | ## Investigate the Insight in Sumo Logic Mobot |
48 | 48 |
|
49 | | -1. From the insight's details page, click **Ask Mobot** to open the AI investigation in [Sumo Logic Mobot](https://www.sumologic.com/help/docs/search/mobot/).<br/><img src={useBaseUrl('img/cse/ask-mobot-buttons.png')} alt="Ask Mobot buttons" style={{border: '1px solid gray'}} width="800" /> |
| 49 | +1. From the insight's details page, click **Ask Mobot** to open the AI investigation in [Sumo Logic Mobot](/docs/search/mobot/).<br/><img src={useBaseUrl('img/cse/ask-mobot-buttons.png')} alt="Ask Mobot buttons" style={{border: '1px solid gray'}} width="800" /> |
50 | 50 | 1. Details about the AI investigation appear in the Sumo Logic Investigation Agent, an AI agentic tool. The entire context of the AI investigation is brought into Mobot so you can quickly drill down for more information about the insight.<br/><img src={useBaseUrl('img/cse/insight-agent-in-mobot.png')} alt="Mobot Investigation Agent" style={{border: '1px solid gray'}} width="600" /> |
51 | 51 | 1. In **Ask Something...**, type a question about the insight using details provided in the **What Happened** section above. For example, you could ask to see logs about the entities mentioned in the text (that is, hosts, users, IP addresses, file hashes, and so on).<br/><img src={useBaseUrl('img/cse/investigation-agent-query.png')} alt="Investigation Agent query" style={{border: '1px solid gray'}} width="600" /> |
52 | 52 | 1. Click **Search** <img src={useBaseUrl('img/cse/search-button-in-mobot.png')} alt="Search button in Mobot" width="30" />. The Investigation Agrent analyzes your request and fashions a query based on it. |
53 | 53 | 1. Click **View Results** to see the results of your request in the logs query UI. You can also click the suggestions provided to drill down farther. As you ask questions, Mobot retains the context of your conversation about the insight, allowing you to more easily obtain detail. <br/><img src={useBaseUrl('img/cse/investigation-agent-results.png')} alt="Investigation Agent query results" style={{border: '1px solid gray'}} width="600" /> |
54 | 54 |
|
55 | | -## Start a new investigation |
| 55 | +### Start a new investigation |
56 | 56 |
|
57 | 57 | To clear the context and start a new investigation, click **New Conversation** in the upper-right corner of the screen. To start investigation on another insight, navigate back to Cloud SIEM, select another insight, and click **Ask Mobot**. |
58 | 58 |
|
59 | 59 | ## FAQs |
60 | 60 |
|
61 | 61 | ### What is the Sumo Logic SOC Analyst Agent? |
62 | 62 |
|
63 | | -The SOC Analyst Agent is part of the Sumo Logic [Dojo AI](/docs/get-started/ai-machine-learning/#whats-new-dojo-ai-for-the-soc). The SOC Analyst Agent is an assistant that applies agentic AI reasoning to triage and investigation tasks. It correlates alerts, weighs patterns against frameworks like MITRE ATT&CK, and renders evidence-backed verdicts, providing analysts an immediate sense of threat impact. When deeper analysis is required, the same agent supports hypothesis-based investigation to map relationships, connect entities, and summarize findings. |
| 63 | +The SOC Analyst Agent is part of the [Sumo Logic Dojo AI](/docs/get-started/ai-machine-learning/#whats-new-dojo-ai-for-the-soc). The SOC Analyst Agent is an assistant that applies agentic AI reasoning to triage and investigation tasks. It correlates alerts, weighs patterns against frameworks like MITRE ATT&CK, and renders evidence-backed verdicts, providing analysts an immediate sense of threat impact. When deeper analysis is required, the same agent supports hypothesis-based investigation to map relationships, connect entities, and summarize findings. |
64 | 64 |
|
65 | | -### What are the benefits of the SOC Analyst Agent? |
| 65 | +### What are the benefits of the agent? |
66 | 66 |
|
67 | 67 | Security teams spend too much time validating false positives and performing repetitive investigative steps. By embedding reasoning and context-awareness directly into Cloud SIEM, the SOC Analyst Agent eliminates noise, standardizes outcomes, and accelerates time to resolution. |
68 | 68 |
|
69 | | -### Will the SOC Analyst Agent increase scanning or data-processing costs? |
| 69 | +### Will the agent increase scanning or data-processing costs? |
70 | 70 |
|
71 | 71 | No. The agent analyzes existing data already ingested into Cloud SIEM. It performs reasoning on metadata and contextual signals rather than initiating new scans. |
72 | 72 |
|
73 | | -### How does the SOC Analyst Agent differ from Cloud SIEM correlation or automation rules? |
| 73 | +### How does the aAgent differ from Cloud SIEM correlation or automation rules? |
74 | 74 |
|
75 | 75 | Unlike traditional correlation logic, which is static, the SOC Analyst Agent applies agentic reasoning. It adapts based on insight context, recent analyst actions, and environmental signals, producing contextual, explainable decisions rather than fixed pattern matches. |
76 | 76 |
|
|
0 commit comments