Surface findings based on risk using the AI Threat Graph Detection agent
Use the AI Threat Graph Detection agent based on the SOC persona of the AI detection engineer to maximize security coverage and operational efficiency by surfacing unknown threats and automating the investigation workflow. The agent identifies hidden malicious activity that bypasses traditional, pattern-matching, and risk-based alerting rules. By gathering context, pivoting across data sources, and stitching the evidence chain, the agent delivers a verdict with confidence scores, supporting events, and explanations, allowing you to focus on threat response instead of writing repetitive queries.
- Intelligent evidence stitching: Combines multiple intermediate findings to build attack chains that exposes the full scope of a cyber-attack, which can otherwise remain hidden as isolated, low-risk noise
- Automated risk elevation: Eliminates the need to manually review high volumes of low-risk, intermediate findings and escalate them to high-risk status.
- Explore beyond predefined rules: Removes the reliance on rigid, predefined risk-based detections to aggregate security events.
- Evidence-based threat identification Automatically correlates all relevant evidence surrounding an intermediate finding and creates actionable findings based on confidence scores, evidence chains, and contextual explanations to identify threats that might have slipped through the cracks.
Turn on the AI threat graph Detection agent
- Turn on at least one risk-based detection.
- Approximately 1 million events must be processed to surface quality findings.
Follow these steps to turn on the AI Threat Graph Detection agent:
- In Splunk Enterprise Security, go to Configure.
- Select AI and then select AI Detection agent settings to configure the agent
- Go to AI Detection agent availability and select On to turn on the agent, select Off to turn off the agent, or select Test to see if the agent is effective in your environment.
Note: Test mode also turns on AI Threat Graph detection. However, in the Test mode, findings created by the agent are routed to a detection test queue whereas in the non-test mode, findings created by the agent are routed to other team based queues, which depends on the triage results for the queue.
-
Go to Finding name prefix to specify what you want to append to the name of the findings that are surfaced by the agent. For example, AI Threat Graph Detection- which helps you to identify or search for the findings in the analyst queue that are surfaced by the agent.
-
In the Maximum findings per day, enter a value between 1 to 1000 to indicate how many maximum findings the agent can surface each day.
Once you run the AI Threat Graph Detection agent on the intermediate findings, the findings that represent outstanding risk are displayed on the Analyst queue. You can filter the findings that have been surfaced by the agent using the Finding name prefix that you had specified when you configured the agent settings.
The following image shows a finding that is surfaced by the AI Threat Graph Detection agent: