Run SOAR response actions using the Guided Response Agent in Splunk Enterprise Security

Identify and run SOAR response actions on findings using the AI-powered Guided Response agent so that you can accelerate the security response in Splunk Enterprise Security by making it accessible to all. For more information on response plans, see Create response plans in Splunk Enterprise Security.

Note: Installing new connectors on SOAR automatically adds those connectors into the pre-selected list of connectors. The Guided Response agent inherits SOAR permissions.
Note: Installing new connectors on SOAR automatically adds those connectors into the pre-selected list of connectors. The agent inherits SOAR permissions.

Following are some ways in which the Guided Response agent can help suggest and run AI-assisted security response actions:

  • Identify the appropriate SOAR response action to run on the finding using a natural language prompt since multiple options to select response actions can create confusion.

  • Run the same response action across multiple connectors simultaneously, if required, to review one indicator of compromise (IOCs) across multiple sources.

  • Define response actions using the guidance provided by the agent based on several parameters in the context of the finding since most SOAR response actions have between three to six parameters.

  • Target multiple observables and run the same response action across several IOCs to get aggregated results for batch enrichment since findings in the real world rarely have a single IOC.

  • Couple data lookups with SOAR response actions so that there is adequate context for the suggested actions to be relevant and useful.

  • Initiate a SOAR response action that waits instead of returning results immediately since many SOAR actions are asynchronous and require human approval.

Note: The Guided Response agent in Splunk Enterprise Security is supported on Cloud if you using either Essential or Premier Edition in Splunk Enterprise Security, where the agentic chat Experience is available.​ You must also upgrade to Splunk Platform version 10.2 or higher and Splunk Enterprise Security version 8.6 or higher. Additionally, you must pair SOAR on your deployment of Splunk Enterprise Security.
Note: No specific capabilities are required to use the Guided Response agent from the AI Assistant for Security. However, you must have permissions to the SOAR connectors that the agent runs. The Guided Response agent inherits the SOAR permissions.

Turn on the Guided Response agent in Splunk Enterprise Security

Follow these steps to turn on the Guided Response agent in Splunk Enterprise Security:

  1. In Splunk Enterprise Security, select Configure and then All configurations.
  2. Select Security AI Assistant settings.
  3. Select the model for your agentic chat. For more information, see Choose which models the AI Assistant uses in Splunk Enterprise Security.
    Note: The Guided Response Agent is not available in SecA1 model of the agentic chat experience.
  4. Turn on the AI Assistant. For more information, see Turn the AI Assistant on or off in Splunk Enterprise Security.

  5. Pair Splunk Enterprise Security with Splunk SOAR to use the Guided Response agent. recommendations. See Pair Splunk Enterprise Security with Splunk SOAR.

Based on your eligibility, you can have access to the Guided Response agent.

Use the Guided Response agent in Splunk Enterprise Security

Follow these steps to use the Guided Response agent in Splunk Enterprise Security:

  1. In Splunk Enterprise Security, go to Automation.
  2. In the agentic chat, enter a prompt such as Run domain reputation on URL or run Run Cisco Talos reputation on IP address xxx.xxx.xx.xxx to trigger the Guided Response agent and identify the most appropriate SOAR response action to run.

The following table provides some sample prompts to run on the agentic chat for this agent:

Sample prompt Action description
Block an IP address <IP address> The agent select the correct IP address to block based on context or provides a list of Ip addresses to block based on context.
Disable a user <username> The agent requests double confirmation prior to disabling a user and the correct user is selected when multiple similar usernames might exist.
Check IP reputation <IP address> The agent summarizes the information on the reputation of the provided IP address.
Enrich an IPaddress <IP address> across multiple threat intelligence sources such as Talos and VirusTotal The agent provides results from both threat intelligence sources side by side and highlights discrepancies between the results surfaced without merging them.
Disable a specific user everywhere <username> The agent disables the user across all identity providers and reports on the success or failure for each system.
Send a Slack message to the <#Slack channel> about a finding The agent drafts a contextually relevant message and sends it to the specified channel.
Open a JIRA ticket for a finding The agent provides the summary and description from the context of the finding and requests a priority level from the analyst.