Friday SIEM post, apparently this is my 30th release 🙌
Before I go into the topic, many reached out saying they really enjoy my Friday SIEM posts, so one of my recent projects was to make this part of my blog as a dedicated section. So now Friday SIEM is on Substack as well. And yes, I migrated my whole blog there too.
Now back to this week’s topic: AI Agent Builders, or Agent Studios as part of the SIEM.
I wrote about this a while ago because I see it as one of the next big trends across SIEMs. And no surprises there, we are already seeing more and more SIEM vendors adding them.
And yes, don’t jump on me for the vendors in the visual. When I say SIEM, I include both the more traditional ones and the SIEM alternatives, next-gen, decoupled, integrated SecOps, whatever we decide to call them this week.
There is also a really cool blog from the Elastic team, a proper deep dive into how they run this internally, with some great insights. One that stood out was how much they improved agent accuracy, not by changing the model, but by giving the agent better context.
That part matters a lot.
Overall, don’t use agents for everything. Go deterministic where you can and where it makes sense. Agents are useful, but they are not some magical replacement for every workflow just because we discovered the word “agentic.”
They also touch on why dumping walls of AI-generated text in front of analysts is not particularly useful. But that is a topic for another Friday SIEM post, because the UX disaster we are creating around AI in SecOps deserves its own rant.
Overall, I think we will see most, if not all, SIEM vendors adding some form of Agent Studio.
What surprised me is that not many added this capability through acquisition. A lot of them seem to be building it in-house. I still suspect we will see at least one acquisition in this space, maybe even this year.
And just to separate two things that are getting mixed together a lot.
When I say AI SOC, I usually mean the pre-built stuff. Investigation agents, triage agents, response agents, all ready to go.
When I say Agent Studio, I mean the build-your-own part. You get templates, tools, connectors and some building blocks, but you can create or customize the agents yourself.
So yes, SIEM added SOAR, then AI SOC, and now Agent Studios as well.
Have a siemless weekend ahead!