Agentic AI offerings in Splunk Enterprise Security

overview of available AI-powered agents

Use the agentic AI offerings in Splunk Enterprise Security to assist with tasks such as creating detections, triaging findings, investigating malicious emails, building playbooks, and so on. The AI agents can help you work through investigations by summarizing findings, explaining activity in clear language, and suggesting next steps. You can also use these agents to explore related activities and create notes or reports directly from an investigation. This accelerates triage and simplifies escalation decisions, evolving your Security Operations Center (SOC) into an autonomous, agentic SOC built to counter machine-speed threats at scale.

Note: The AI features in Splunk Enterprise Security are subject to Microsoft's Azure OpenAI

Acceptable Use Policy

and Code of Conduct Content requirements.

Compatibility information for AI agents in Splunk Enterprise Security

The following table provides information on the AI agents in Splunk Enterprise Security such as compatibility and availability:

Agent name Agentic SOC function Description Availability Compatibility information
Automation Builder agent Detection and security engineering Build and explain new and existing playbooks and their associated information. For more information, see Use the Automation Builder Agent to build and understand playbooks. Essentials and Premier (Cloud only)

  • Paired SOAR instance on your deployment of Splunk Enterprise Security

  • Splunk Enterprise Security version 8.6 or higher
Connector Builder Agent Detection and security engineering Create connectors faster with an AI agent that can generate, test, and refine connectors, increasing automation coverage across more tools. For more information, see Create and edit connectors with the Connector Builder Agent Essentials and Premier (Cloud only)
  • Paired SOAR instance on your deployment of Splunk Enterprise Security
  • Splunk Enterprise Security version 8.7 or higher
Detection Builder agent Detection and security engineering Create, tune, validate, and troubleshoot detections using the integrated AI Assistant available in the detection editors to optimize their effectiveness and reduce the time required to create the SPL query. For more information, see Author detections using the Detection Builder agent in Splunk Enterprise Security. Essentials and Premier (Cloud and Cloud Connected on-premises)
  • Splunk Platform version 10.1.x or higher (for Cloud)

  • Splunk Platform version 10.4.x or higher, Splunk Enterprise Security version 8.8 and higher, and Splunk Cloud Connect app version 2.0 from Splunkbase. (for Cloud Connected customer managed platforms (CMP)).
AI Threat Graph Detection agent Detection and security engineering Surface findings that indicate hidden malicious activity that bypasses traditional, pattern-matching, and risk-based alerting rules. For more information, see Surface findings based on risk using the AI Threat Graph Detection agent in Splunk Enterprise Security.
Note: This feature is in alpha phase. Contact your Splunk representative to turn on the agent.
Premier (Cloud only) Splunk Enterprise Security version 8.8 or higher
Triage and Response agent Investigation and response Improves the quality and consistency of security decisions through an end-to-end explainable AI-assisted workflow from detection and triage to investigation and response. For more information, see Use SOC agent in Splunk Enterprise Security.
Note: Contact your Splunk representative to turn on the SOC agent.
Premier (Cloud and Cloud Connected on-premises)
  • Splunk Platform version 10.2.x or higher (for Cloud) and Splunk Enterprise Security version 8.6 or higher (for Cloud)
  • Paired SOAR instance on your deployment of Splunk Enterprise Security

  • Splunk Platform version 10.4.x or higher, Splunk Enterprise Security version 8.8 and higher, and Splunk Cloud Connect app version 2.0 from Splunkbase. (for Cloud Connected customer managed platforms (CMP)).
Guided response agent Investigation and response Identify and run SOAR response actions on findings to accelerate security repsonse. Essentials and Premier (Cloud only)
  • Splunk Platform version 10.2 or higher
  • Splunk Enterprise Security version 8.6 or higher
  • Pair SOAR on your deployment of Splunk Enterprise Security.
Malware Reversing and Phishing agent Threat hunting Review and investigate potentially malicious scripts by automatically generating a structured summary of script behavior to help reverse malware or analyze a phishing attempt. For more information, see Analyze scripts using the AI-powered Malware Reversing Agent and Phishing Analysis Agent in Splunk Enterprise Security. Premier (Cloud only)
  • Splunk Enterprise Security version 8.5 or higher
  • Paired SOAR instance on your deployment of Splunk Enterprise Security
.
Standard Operation Procedure (SOP) agent Investigation and response Import an existing Standard Operation Procedure (SOP) in Splunk Enterprise Security and convert it into a structured response plan. For more information, see Create response plans with the SOP agent. Essentials and Premier (Cloud only)

  • Enterprise Security AI assistant enabled on your Enterprise Security deployment.

  • Individuals using the SOP agent must have view and edit response template capabilities.
Note: Agentic chat version 1 is available on both on-premises and Cloud deployments of Splunk Enterprise Security. Agentic chat model version 2 is available on Cloud only.