An agent that reads the alert and the reported email first, so analysts start from the evidence.
The problem
Most alerts turn out to be noise, and an analyst has to open each one to find out: who the user is, what the device is, whether the same thing has fired before and what else happened around it. Reported phishing emails are the same, read one at a time to check the sender, the links and who else received the message.
That first look follows a runbook, and the evidence is in records the team already keeps. An agent can gather it for every alert and every report, so the analyst decides on the evidence instead of spending the time collecting it.
What the agent does
- Reads each alert, pulls in the user, the device and the related events, and checks it against known false positives
- Reviews each reported email: the sender, the headers, the links and attachments, and who else received the same message
- Writes a summary with a suggested verdict and the evidence behind it, for an analyst to confirm or overturn
- Asks before it takes any action, such as closing an alert, pulling an email from inboxes or blocking a sender
Systems it works in
- Security alerting: alerts and their related events
- Email system: reported messages and their recipients
- Identity provider: the user and their sign-in history
- Endpoint management: the device and its state
- Case management: the incident record and its runbook
How it is measured
- Agent-to-human ratio: how many alerts and reports the agent triaged, and how many an analyst still worked from scratch
- Quality: how often the analyst agreed with the agent’s verdict, and how often the analyst found something the agent missed
- Coverage: the share of alerts and reported emails that had a summary before an analyst opened them
No demo is recorded for this work. The recorded demos show the same agent on revenue and customer success work, asking before it changes anything.