You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We're excited to announce two new powerful AI capabilities to assist in your Security Operation Center (SOC) team's investigation of Cloud SIEM insights:
15
+
* SOC Analyst Agent in Cloud SIEM
16
+
* Investigation Agent in Mobot
17
+
18
+
These powerful AI tools will improve the speed and accuracy of your SOC team to investigate threats.
19
+
20
+
#### SOC Analyst Agent
21
+
22
+
A new **AI Investigation** tab in Cloud SIEM provides an AI-generated analysis of insights that accelerates investigation and troubleshooting by your SOC team. The information in the tab is generated by Sumo Logic's SOC Analyst Agent, an agentic AI tool.
When you select the **Ask Mobot** button on the new **AI Investigation** tab, the insight's AI-generated information is launched in Sumo Logic Mobot. There you can use the Sumo Logic Investigation Agent to drill down into the insight for greater detail.
This new functionality is available for participants in our beta program. To request access, contact your Sumo Logic account representative or Support.
Copy file name to clipboardExpand all lines: docs/cse/get-started-with-cloud-siem/ai-investigation-of-insights.md
+10-5Lines changed: 10 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
id: ai-investigation-of-insights
3
-
title: AI Investigation of Cloud SIEM Insights
3
+
title: AI Investigation of Insights
4
4
sidebar_label: AI Investigation of Insights
5
5
description: Learn how to perform investigations of a Cloud SIEM insights assisted by Sumo Logic artificial intelligence tools.
6
6
---
@@ -21,11 +21,10 @@ reasoning to determine whether the insights are malicious, suspicious, or benign
21
21
***Investigation**. Supports analysts with a hypothesis-driven approach to assess
22
22
the scope, context, and likely impact of an event.
23
23
24
-
## View the AI Investigation tab of an insight
24
+
## View the AI Investigation tab
25
25
26
26
1.[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM > Insights**. You can also click **Go To...** at the top of the screen and select **Insights**. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main menu select **Cloud SIEM** and then click **Insights** at the top of the screen.
27
-
1. In the insight list page, note that the **AI Verdit** column shows the results of the AI analysis.<br/><img src={useBaseUrl('img/cse/insight-ai-verdict-column.png')} alt="Insight AI Verdict column" style={{border: '1px solid gray'}} width="800" />
28
-
1. Click an insight.
27
+
1. On the insights list page, click an insight.
29
28
1. The insight details are displayed. The **AI Investigation** tab for the insight shows the results of the AI analysis:<br/><img src={useBaseUrl('img/cse/insight-ai-investigation-tab.png')} alt="Insight AI Investigation tab" style={{border: '1px solid gray'}} width="800" />
30
29
1.**Severity Verdict**. Details about the insight's severity analysis:
31
30
***Current Severity**. The severity of the insight as set by the cumulative activity score for the insight. For more information, see [About insight severity](/docs/cse/get-started-with-cloud-siem/insight-generation-process/#about-insight-severity).
@@ -44,7 +43,13 @@ the scope, context, and likely impact of an event.
44
43
1.**Key Findings**. The main points uncovered by AI analysis. Details about these findings can be found in the signals that fired for the insight.
45
44
1.**Ask Mobot**. Click to send the AI analysis of the insight to Sumo Logic Mobot for further investigation.
46
45
47
-
## Investigate the Insight in Sumo Logic Mobot
46
+
### Filter for AI verdicts
47
+
48
+
In the insight list page, that the **AI Verdit** column shows the results of the AI analysis:<br/><img src={useBaseUrl('img/cse/insight-ai-verdict-column.png')} alt="Insight AI Verdict column" style={{border: '1px solid gray'}} width="800" />
49
+
50
+
Click in the **Filters** area near the top of the insights page and select **AI Verdict** to search for insights based on the verdict they are assigned (Benign, Inconclusive, In Progress, Malicious, Suspicious). See [Filtering insights](/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui/#filtering-insights) for more information about filtering.
51
+
52
+
## Investigate the insight in Mobot
48
53
49
54
1. From the insight's details page, click **Ask Mobot** to open the AI investigation in [Sumo Logic Mobot](/docs/search/mobot/).<br/><img src={useBaseUrl('img/cse/ask-mobot-buttons.png')} alt="Ask Mobot buttons" style={{border: '1px solid gray'}} width="800" />
50
55
1. Details about the AI investigation appear in the Sumo Logic Investigation Agent, an AI agentic tool. The entire context of the AI investigation is brought into Mobot so you can quickly drill down for more information about the insight.<br/><img src={useBaseUrl('img/cse/insight-agent-in-mobot.png')} alt="Mobot Investigation Agent" style={{border: '1px solid gray'}} width="600" />
0 commit comments