Agentic AI offerings in Splunk Enterprise Security

overview of available AI-powered agents

Use the agentic AI offerings in Splunk Enterprise Security to assist with tasks such as creating SPL for detections, triaging findings, investigating malicious scripts, building playbooks, and so on. The AI agents can help you work through investigations by summarizing findings, explaining activity in clear language, suggesting next steps. You can also use these agents to explore related activity and create notes or reports directly from an investigation. This can save time during triage and help you decide when to escalate, thus transforming your security operations center (SOC) into a truly agentic SOC.

Splunk Enterprise Security offers AI-powered agents based on security operations center (SOC) functions to make the detection, investigation, analysis, and response to security threats faster and easier:

*Detection and security engineering

*Investigation and response

*Threat hunting

*Governance and policy

Note: The SOC analyst agent include the Triage agent, which is available in ES Essentials and the Response agent, which is available in ES Premier.
Note: The AI features in Splunk Enterprise Security are subject to Microsoft's Azure OpenAI

Acceptable Use Policy

and Code of Conduct Content requirements.
In Splunk Enterprise Security version 8.8 and higher, the following agentic SOC offerings are supported on both Cloud and Cloud Connected customer managed platforms (CMP).
  • Detection Builder Agent
  • SOC analyst agent
  • Investigation Agent
Note: To support the SOC agentic workforce on Splunk Cloud Connect customer managed platforms (CMP), you must have Splunk Platform version 10.4 or higher and Splunk Enterprise Security version 8.8 and higher. You must also download the Splunk Cloud Connect app version 2.0 from Splunkbase. For more information on accessing Splunk Cloud Connect on Splunkbase, see Access Splunk Cloud Connect in Splunk Enterprise Security to access Cloud extensions.

Compatibility information for AI agents in Splunk Enterprise Security

The following table provides information on the AI agents in Splunk Enterprise Security such as compatibility and availability:

Agent name Agentic SOC function Description Availability Compatibility information
Automation Builder agent Detection and security engineering Build and explain new and existing playbooks and their associated information. For more information, see Use the Automation Builder Agent to build and understand playbooks. Essentials and Premier (Cloud only)

  • Paired SOAR instance on your deployment of Splunk Enterprise Security

  • Splunk Enterprise Security version 8.6 or higher (for Cloud)

  • Splunk Platform version 10.4.x or higher, Splunk Enterprise Security version 8.8 and higher
Connector Builder Agent Detection and security engineering Create connectors faster with an AI agent that can generate, test, and refine connectors, increasing automation coverage across more tools. For more information, see Create and edit connectors with the Connector Builder Agent Essentials and Premier (Cloud only)
  • Paired SOAR instance on your deployment of Splunk Enterprise Security
  • Splunk Enterprise Security version 8.7 or higher (for Cloud)

  • Splunk Platform version 10.4.x or higher, Splunk Enterprise Security version 8.8 and higher.
Detection Builder agent Detection and security engineering Create, tune, validate, and troubleshoot detections using the integrated AI Assistant available in the detection editors to optimize their effectiveness and reduce the time required to create the SPL query. For more information, see Author detections using the Detection Builder agent in Splunk Enterprise Security. Essentials and Premier (Cloud and Cloud Connected customer managed platforms (CMP))
  • Splunk Platform version 10.1.x or higher (for Cloud)

  • Splunk Platform version 10.4.x or higher, Splunk Enterprise Security version 8.8 and higher, and Splunk Cloud Connect app version 2.0 from Splunkbase. (for Cloud Connected customer managed platforms (CMP)).
Threat Graph Detection agent Detection and security engineering Surface findings that indicate hidden malicious activity that bypasses traditional, pattern-matching, and risk-based alerting rules. For more information, see Surface findings based on risk using the AI Threat Graph Detection agent in Splunk Enterprise Security.
Note: This agent is in alpha phase. Contact your Splunk representative to turn on the agent.
Premier (Cloud only) Splunk Enterprise Security version 8.8 or higher
AI SOC analyst agent Investigation and response Improves the quality and consistency of security decisions through an end-to-end explainable AI-assisted workflow from detection and triage to investigation and response. For more information, see Use SOC agent in Splunk Enterprise Security.
Note: Contact your Splunk representative to turn on the SOC agent.
Premier (Cloud and Cloud Connected customer managed platforms (CMP)
  • Splunk Platform version 10.2.x or higher (for Cloud) and Splunk Enterprise Security version 8.6 or higher (for Cloud)
  • Paired SOAR instance on your deployment of Splunk Enterprise Security

  • Splunk Platform version 10.4.x or higher, Splunk Enterprise Security version 8.8 and higher, and Splunk Cloud Connect app version 2.0 from Splunkbase. (for Cloud Connected customer managed platforms (CMP)).
Malware Reversing and Phishing agent Threat hunting Review and investigate potentially malicious scripts by automatically generating a structured summary of script behavior to help reverse malware or analyze a phishing attempt. For more information, see Analyze scripts using the AI-powered Malware Reversing Agent and Phishing Analysis Agent in Splunk Enterprise Security. Premier (cloud only)
  • Splunk Enterprise Security version 8.5 or higher
  • Paired SOAR instance on your deployment of Splunk Enterprise Security
.
Standard Operation Procedure (SOP) agent Investigation and response Import an existing Standard Operation Procedure (SOP) in Splunk Enterprise Security and convert it into a structured response plan. For more information, see Create response plans with the SOP agent. Essentials and Premier (Cloud only)

  • Enterprise Security AI assistant enabled on your Enterprise Security deployment.

  • Individuals using the SOP agent must have view and edit response template capabilities.
Note: Agentic chat version 1 is available on both on-premises and Cloud deployments of Splunk Enterprise Security. Agentic chat model version 2 is available on Cloud only.

To configure AI settings for your organization, see Configure global AI settings .