Agents
Tier 1 speed, Tier 2 investigation, Tier 3 engineering. The agents do the legwork on your alerts; your analysts make the calls.
Tiers
Each agent has one job, and each job leaves evidence in the ledger.
Tier 1
Keeps the alert queue clean and the data flowing.
Groups related alerts and closes known noise with a recorded reason.
Watches each agreed log source and flags one that goes quiet or changes format.
Re-tests detection paths so a rule that stopped firing is caught.
Tier 2
Works a case the way an analyst would, then stops for approval.
Gathers context from your logs and drafts a case summary with its evidence.
Recommends a containment step and waits for an analyst to approve it.
Writes the case report and the evidence trail for your auditors.
Tier 3
Improves the detections themselves.
Drafts new and tuned rules for your analysts to review.
Tests each rule against the behaviour it should catch before it goes live.
Tracks new threats and critical CVEs and starts Zero-Day Watch.
Autonomy
Agents start at the bottom of the ladder. Your team decides when, and for which actions, they move up.
Level
Agents work alongside your team and record what they would have done. Nothing changes.
Level
Agents recommend a verdict and an action. Analysts decide.
Level
Agents prepare the action. It runs only after an analyst approves it.
Level
Low-risk action classes your team approved in advance run under your policy, and each run is logged.
You set the level per action type. Autonomy is granted slowly and can be withdrawn in one step.
People
The agents take the repetitive work. These decisions stay with your team.
Example
Illustrative flow. Not a real incident or customer.
Triage agent
Reads a suspicious sign-in alert from your SIEM and groups it with two related alerts.
Investigation agent
Pulls identity and endpoint context and drafts a case summary.
Investigation agent
Attaches the evidence behind the verdict: the matching log lines and the rule that fired.
Response agent
Recommends disabling the session token and explains why.
Analyst
Reviews the evidence and approves the action in Slack.
Reporting agent
Records the case, the approval and the outcome in the Evidence Ledger.
The numbers in this flow are step numbers, not timings.
FAQ
An AI SOC analyst is an AI agent that does the alert work of a Tier 1 or Tier 2 analyst: it triages each alert, checks it against your telemetry, investigates related activity and writes a verdict with the evidence behind it. In SOCGenX, analysts approve every response action and decide on escalations.
An agentic SOC is a security operations center where AI agents carry out multi-step work, such as triage, investigation and detection engineering, instead of only scoring alerts. SOCGenX runs Tier 1, Tier 2 and Tier 3 agents governed by your policies, on an autonomy ladder you control.
Agents recommend containment steps. Nothing changes in your environment until an analyst approves it, and you decide how far each agent moves up the autonomy ladder.
We run the agents in shadow mode on your own data, so you see what they would do before they do anything.
