Splunk unifies the SOC experience with AI agents as all-rounders

"Splunk Enterprise Security Essentials: old becomes new Splunk Enterprise Security 8.2, the latest release, is the first piece of the Essentials puzzle. The well-known Splunk AI Assistant within Security is part of this solution, while Detection Studio completes it. This feature revolves around all phases of detection, from the test period to continuous monitoring. In short: Essentials flattens out some things that would otherwise be separate options."

"AI agents "orchestrate and automate complex workflows" within ES, including agents for triage, reversing malware infections, and creating SOAR playbooks. Agents must also adhere to the best practices and SOPs (standard operating procedures) of a SOC. Multimodal AI models help to provide ES with these SOPs, which then become the agents' basic knowledge. Within the Essentials package, Splunk ES also makes it possible to expand detection libraries and personalize detections in Splunk Processing Language (SPL)."

Splunk Enterprise Security Essentials centers on the 8.2 release, embedding the Splunk AI Assistant and Detection Studio to cover detection from testing through continuous monitoring. Essentials consolidates separate capabilities and serves as a platform for agent-driven orchestration and automation of complex SOC workflows. Agents operate using SOPs supplied by multimodal AI models and can expand detection libraries and customize detections in Splunk Processing Language (SPL). Cisco integration enables agentic actions like automatically creating Webex "war rooms" for triggered incidents. The Premier edition adds Splunk SOAR and UEBA on top of Essentials for broader response and behavioral analytics.

Read at Techzine Global