Hey everyone I have been basically tasked with the impossible of trying to create an agentic soc for our environment that basically will triage alerts.

I work for a small business and was dabbling into some vendors that support this ask and from what I’ve seen it all looks the same type of slop that I just don’t see myself trusting yet. It looks like you have this product that the company promises can triage alerts for you yet you still have to be looking at alerts to make sure the ai is doing its job correctly. I’m not in the market to babysit ai as I don’t think that is feasible long term because I am simply just making the work being done faster but it is all benign work anyway.

But I stumbled up a an idea to the madness and wondering if it is possible to develop an agent that acts as the detection for our environment so there would no longer be a queue with several detections put in place and once users hit that risk threshold then the team investigates whatever it finds as borderline suspicious.

So instead of us having detections put in place to catch things the ai itself is the detection and will monitor everything that’s coming in and out of our environment and also alert us on just the important things that need to be investigated.

I guess to accomplish something like this I would need to train the ai by feeding it siem logs ticket logs and have it spit out anything that is abnormal and compare that to the normal activity from our users and go from there?

With that being said I am wanting to ask what all you have done in the state of ai being incorporated with the soc? Did your analysts just triage alerts with it or are you guys able to do other things.

Were you able to accomplish something similar or find a product that meets that need?

Edit: Thank you guys for commenting on this so quickly I appreciate you all!