You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn about the AI verdicts for Cloud SIEM insights.
3
+
title: AI Investigation of Cloud SIEM Insights
4
+
sidebar_label: AI Investigation of Insights
5
+
description: Learn how to perform investigations of a Cloud SIEM insights assisted by Sumo Logic artificial intelligence tools.
6
6
---
7
7
8
8
<head>
@@ -16,18 +16,18 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
16
16
The **AI Investigation** tab in the details page of a Cloud SIEM insight is an AI-generated analysis of the insight that accelerates investigation and troubleshooting by your Security Operations Center (SOC) team. The information in the tab is generated by Sumo Logic's SOC Analyst Agent, an agentic AI tool.
17
17
18
18
The SOC Analyst Agent performs two distinct jobs that mirror an analyst’s daily responsibilities:
19
-
* Triage. Delivers automated verdicts on insights using evidence-backed
19
+
***Triage**. Delivers automated verdicts on insights using evidence-backed
20
20
reasoning to determine whether the insights are malicious, suspicious, or benign.
21
-
* Investigation. Supports analysts with a hypothesis-driven approach to assess
21
+
***Investigation**. Supports analysts with a hypothesis-driven approach to assess
22
22
the scope, context, and likely impact of an event.
23
23
24
-
## View the AI Investigation tab
24
+
## View the AI Investigation tab of an insight
25
25
26
26
1.[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM > Insights**. You can also click **Go To...** at the top of the screen and select **Insights**. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main menu select **Cloud SIEM** and then click **Insights** at the top of the screen.
27
27
1. In the insight list page, note that the **AI Verdit** column shows the results of the AI analysis.<br/><img src={useBaseUrl('img/cse/insight-ai-verdict-column.png')} alt="Insight AI Verdict column" style={{border: '1px solid gray'}} width="800" />
28
28
1. Click an insight.
29
29
1. The insight details are displayed. The **AI Investigation** tab for the insight shows the results of the AI analysis:<br/><img src={useBaseUrl('img/cse/insight-ai-investigation-tab.png')} alt="Insight AI Investigation tab" style={{border: '1px solid gray'}} width="800" />
30
-
1.**Severity Verdict**.
30
+
1.**Severity Verdict**. Details about the insight's severity analysis:
31
31
***Current Severity**. The severity of the insight as set by the cumulative activity score for the insight. For more information, see [About insight severity](/docs/cse/get-started-with-cloud-siem/insight-generation-process/#about-insight-severity).
32
32
***Global Confidence Score**. A level of confidence that the insight is actionable, predicted by Sumo Logic’s Global Intelligence machine learning model. See [What is a Global Confidence score?](/docs/cse/records-signals-entities-insights/global-intelligence-security-insights/#what-is-a-global-confidence-score).
33
33
***AI Verdict**. The AI system's qualitative assessment of the insight. Following are the available verdicts:
@@ -36,9 +36,48 @@ the scope, context, and likely impact of an event.
36
36
***In Progress**. AI analysis is in process.
37
37
***Malicious**. AI analysis determined that the insight is malicious, and warrants immediate investigation by your SOC team.
38
38
***Suspicious**. AI analysis determined that the insight is suspicious and warrants investigation by your SOC team.
39
-
***Recommends security level of**. AI analysis recommends a severity level be assigned to this insight. If you agree with the assessment, click **Accept**. The **Current Severity** field changes to the new value.
40
-
1.**What Happened**.
41
-
1.**Key Findings**.
42
-
1.**Ask Mobot**.
39
+
***Recommends security level of ___**. AI analysis recommends a new severity level be assigned to this insight. If you agree with the assessment, click **Accept**. The **Current Severity** field changes to the new value.
40
+
1.**What Happened**. A concise summary of threat incidents based on triggered signals in the insight. Content of this field is generated by Sumo Logic's Summary Agent, an agentic AI tool. The summary consolidates key details to facilitate quick understanding and response by security teams. The summary is generated when an insight is created, and is regenerated whenever the insight is modified, keeping it current with added or removed signals.
41
+
:::tip
42
+
Help us refine the tool by using the thumbs-up or thumbs-down buttons to provide feedback on the effectiveness of the summary presented. Clicking the thumbs-down button gives you the opportunity to provide additional feedback.
43
+
:::
44
+
1.**Key Findings**. The main points uncovered by AI analysis. Details about these findings can be found in the signals that fired for the insight.
45
+
1.**Ask Mobot**. Click to send the AI analysis of the insight to Sumo Logic Mobot for further investigation.
43
46
47
+
## Investigate the Insight in Sumo Logic Mobot
44
48
49
+
1. From the insight's details page, click **Ask Mobot** to open the AI investigation in [Sumo Logic Mobot](https://www.sumologic.com/help/docs/search/mobot/).<br/><img src={useBaseUrl('img/cse/ask-mobot-buttons.png')} alt="Ask Mobot buttons" style={{border: '1px solid gray'}} width="800" />
50
+
1. Details about the AI investigation appear in the Sumo Logic Investigation Agent, an AI agentic tool. The entire context of the AI investigation is brought into Mobot so you can quickly drill down for more information about the insight.<br/><img src={useBaseUrl('img/cse/insight-agent-in-mobot.png')} alt="Mobot Investigation Agent" style={{border: '1px solid gray'}} width="600" />
51
+
1. In **Ask Something...**, type a question about the insight using details provided in the **What Happened** section above. For example, you could ask to see logs about the entities mentioned in the text (that is, hosts, users, IP addresses, file hashes, and so on).<br/><img src={useBaseUrl('img/cse/investigation-agent-query.png')} alt="Investigation Agent query" style={{border: '1px solid gray'}} width="600" />
52
+
1. Click **Search** <img src={useBaseUrl('img/cse/search-button-in-mobot.png')} alt="Search button in Mobot" width="30" />. The Investigation Agrent analyzes your request and fashions a query based on it.
53
+
1. Click **View Results** to see the results of your request in the logs query UI. You can also click the suggestions provided to drill down farther. As you ask questions, Mobot retains the context of your conversation about the insight, allowing you to more easily obtain detail. <br/><img src={useBaseUrl('img/cse/investigation-agent-results.png')} alt="Investigation Agent query results" style={{border: '1px solid gray'}} width="600" />
54
+
55
+
## Start a new investigation
56
+
57
+
To clear the context and start a new investigation, click **New Conversation** in the upper-right corner of the screen. To start investigation on another insight, navigate back to Cloud SIEM, select another insight, and click **Ask Mobot**.
58
+
59
+
## FAQs
60
+
61
+
### What is the Sumo Logic SOC Analyst Agent?
62
+
63
+
The SOC Analyst Agent is part of the Sumo Logic [Dojo AI](/docs/get-started/ai-machine-learning/#whats-new-dojo-ai-for-the-soc). The SOC Analyst Agent is an assistant that applies agentic AI reasoning to triage and investigation tasks. It correlates alerts, weighs patterns against frameworks like MITRE ATT&CK, and renders evidence-backed verdicts, providing analysts an immediate sense of threat impact. When deeper analysis is required, the same agent supports hypothesis-based investigation to map relationships, connect entities, and summarize findings.
64
+
65
+
### What are the benefits of the SOC Analyst Agent?
66
+
67
+
Security teams spend too much time validating false positives and performing repetitive investigative steps. By embedding reasoning and context-awareness directly into Cloud SIEM, the SOC Analyst Agent eliminates noise, standardizes outcomes, and accelerates time to resolution.
68
+
69
+
### Will the SOC Analyst Agent increase scanning or data-processing costs?
70
+
71
+
No. The agent analyzes existing data already ingested into Cloud SIEM. It performs reasoning on metadata and contextual signals rather than initiating new scans.
72
+
73
+
### How does the SOC Analyst Agent differ from Cloud SIEM correlation or automation rules?
74
+
75
+
Unlike traditional correlation logic, which is static, the SOC Analyst Agent applies agentic reasoning. It adapts based on insight context, recent analyst actions, and environmental signals, producing contextual, explainable decisions rather than fixed pattern matches.
76
+
77
+
### What data does the agent rely on to render verdicts?
78
+
79
+
The agent draws from normalized security data (`sec_record*` indexes and signals), correlated entities, Sumo Logic’s integrated threat intelligence feeds, and enrichment data (for example, geo-IP, user behavior, asset details).
80
+
81
+
### Can analysts provide feedback or correct AI verdicts?
82
+
83
+
Yes. Analysts can override verdicts and flag feedback within the UI. These actions are logged and reviewed to refine model behavior over time as part of the Dojo AI learning loop.
0 commit comments