Turn on or turn off the triage agent
-
You must have the
es_ai_edit_settingscapability assigned to your role in order to use the AI triage agent. -
You must pair Splunk Enterprise Security with Splunk SOAR to use third-party connector data in agent recommendations. See Pair Splunk Enterprise Security with Splunk SOAR.
-
You must turn on the AI Assistant in order to use the AI triage agent. See Turn the AI Assistant on or off in Splunk Enterprise Security.
- In Splunk Enterprise Security, select Configure and then All configurations.
- Select Triage agent.
- In the AI agent activation box, turn on or turn off Allow the AI agent to review findings in your queue.