Surface findings based on risk using the AI Threat Graph Detection agent

Note: The AI Threat Graph Detection agent is released as an alpha feature for Splunk Enterprise Security Premier version 8.8.

Use the AI Threat Graph Detection agent to maximize security coverage and operational efficiency by surfacing unknown threats. The agent identifies hidden malicious activity that bypasses traditional, pattern-matching, and risk-based alerting rules. By gathering context, pivoting across data sources, and stitching the evidence chain, the agent delivers a finding with a confidence score, supporting events, and description, allowing you to focus on threat response instead of writing repetitive queries.

Key benefits include:
  • Intelligent evidence stitching: Combines multiple intermediate findings to build attack chains that exposes the full scope of a cyber-attack, which can otherwise remain hidden as isolated, low-risk noise
  • Near miss detection: Find malicious activity from sophisticated adversaries deliberately avoiding detection with rare subtle events.
  • Automated risk elevation: Eliminates the need to manually review high volumes of low-risk, intermediate findings and escalate them to high-risk status.
  • Explore beyond predefined rules: Removes the reliance on rigid, predefined risk-based detections to aggregate security events.
  • Evidence-based threat identification Automatically correlates all relevant evidence surrounding an intermediate finding and creates actionable findings based on confidence scores, evidence chains, and contextual explanations to identify threats that might have slipped through the cracks.

Turn on the AI threat graph Detection agent

Note: Turning on this feature allows you to process 24 hours of findings in under 30 minutes. The feature requires 1 million events to baseline normal behavior before recommending findings.
Prerequisites
  • Turn on at least one risk-based detection.
  • Approximately 1 million events must be processed before any findings are created.

Follow these steps to turn on the AI Threat Graph Detection agent:

  1. In Splunk Enterprise Security, go to Configure.
  2. Select AI and then select AI Detection agent settings to configure the agent
  3. Go to AI Detection agent availability and select On to turn on the agent, select Off to turn off the agent, or select Test to see if the agent is effective in your environment.
    Note: The Test mode also turns on AI threat graph detection. However, the Test mode routes findings created by AI detection to the detection test queue whereas when you turn on the agent, findings are routed to other team-based queues based on the triage results for the queue.

  4. Go to Finding name prefix to specify what you want to append to the name of the findings that are surfaced by the agent. For example, AI Threat Graph Detection- which helps you to identify or search for the findings in the analyst queue that are surfaced by the agent.

  5. In the Maximum findings per day, enter a value between 1 to 1000 to indicate how many maximum findings the agent can surface each day.

Once you run the AI Threat Graph Detection agent on the intermediate findings, the findings that represent outstanding risk are displayed on the Analyst queue. You can filter the findings that have been surfaced by the agent using the Finding name prefix that you had specified when you configured the agent settings.

The following image shows a finding surfaced by the AI Threat Graph Detection agent: