SOC agents value dashboard

The SOC agents value dashboards are designed to provide insight into the capabilities, performance, and effectiveness of the AI agentic offerings in Splunk Enterprise Security. These dashboards monitor the value provided for your security operations center (SOC) by the various agents based on key metrics and workflows such as triaging and time saved through automation. For more information on AI agentic offerings in Splunk Enterprise Security, see Agentic AI offerings in Splunk Enterprise Security.

Prerequisite: To view the SOC agents value dashboard, you must have ES Premier Edition (Cloud only) and the Triage agent must be turned on.

Note: You can display the dashboard results based on the time range selected such as 7 days or 24 hours, and so on. You can also filter the results based on a specific agent type such as Triage agent.

Available dashboards

The following table provides the dashboards included in the SOC agents value dashboard:

Panel Description
Executive summary Provides a high level insight into the key findings surfaced and mitigated by the agent so that executives can evaluate productivity gain due to the agent. Includes the Analyst Applied
Effectiveness Provides insight into the effectiveness of the agent.
ROI Provides a comparison of the productivity gain due to triage by agents versus the triage by analysts.
Operations Provides insight into the execution of a pre-configured action or capability by an Agentic AI assistant.

Dashboard key indicators and panels

The following table lists the key indicators and dashboard panels in the Executive summary dashboard under the SOC agents value dashboard:

Panel Description
Findings triaged Number of findings triaged by the agent
Dispositions provided Number of dispositions provided by the agent
Analyst applied Pie chart indicating the distribution of false positives, true positives, benign positives and unknown dispositions provided by an analyst
Agent determination Pie chart indicating the distribution of false positives, true positives, benign positives and unknown dispositions provided by an agent
SOC time returned Indicates the estimated amount of time saved due to the use of the agent.
The following table lists the key indicators and dashboard panels in the Effectiveness dashboard under the SOC agents value dashboard:
Panel Description
Agent triage lifecycle Displays the final resolution outcome for findings that were processed by analysts
Agent versus analyst disposition matrix Displays a comparison of the disposition provided to findings by the agent versus the analysts.

The following table lists the key indicators and dashboard panels in the ROI dashboard under the SOC agents value dashboard:

Panel Description
SOC Time returned by Agent Dispositions Indicates the time returned to the SOC teams by the agent.
Agent output vs analyst-applied outcome Graphical comparison of the disposition provided to findings by the agent versus the analysts.

The following table lists the key indicators and dashboard panels in the ROI dashboard under the SOC agent value dashboard:

The following table lists the key indicators and dashboard panels in the ROI dashboard under the SOC agent value dashboard:

The following table lists the key indicators and dashboard panels in the Operations dashboard under the SOC agents value dashboard:

Panel Description
Tool call status Indicates the completed, retried, and failed communication attempts made by the agent.