Turn on or turn off the Triage agent
-
You must have the
es_ai_edit_settingscapability assigned to your role in order to use the Triage agent. -
You must pair Splunk Enterprise Security with Splunk SOAR to use third-party connector data in agent recommendations. See Pair Splunk Enterprise Security with Splunk SOAR.
-
You must turn on the AI Assistant in order to use the Triage agent. See Turn the AI Assistant on or off in Splunk Enterprise Security.
Note: Only frontier models for the Triage agent are supported. Selecting support for the Splunk hosted option does not apply. If this is incompatible with your deployment, you must not turn on the agent.
- In Splunk Enterprise Security, select Configure and then All configurations.
- Select Triage agent.
- In the AI agent activation box, turn on or turn off Allow the AI agent to review findings in your queue.