Detect, enrich, triage, investigate, respond. This diagram appears in every AI SOC deck, and it describes an agentic investigation about as usefully as “gather ingredients, cook, serve” describes a restaurant.
The work that happens between the boxes: which tool the agent queries next, what it does when the second query contradicts the first, how it knows when to stop, and what happens when the evidence it is reading was written by an attacker who knew an agent would read it.
Below is one alert from the moment it fires to the moment a person sees a conclusion, followed by the four questions that determine whether any of it can be trusted. The example is a phishing report, the alert type SOCs see most often and where shortcuts are easiest to spot.
Before the agent starts
An alert does not arrive clean. It arrives as whatever the source tool emitted, in that tool’s schema, alongside a few thousand others.
Each source describes the same event differently. In one SIEM, a failed login is [status=401]. In another, it is [failureReason=invalidCredentials]. In a third, it is an event ID with the reason buried in a description string. 7AI takes alerts from every connected detection source across identity, endpoint, cloud, email, and SIEM in the format each source emitted, keeps the original alert intact, and identifies the entities the investigation will run on: users, hosts, IPs, domains, file hashes, and email addresses.
Grouping comes second. One attack often fires several alerts across different tools, and repeats of the same alert pile up in the queue. 7AI clusters related alerts into a single investigation, matching on the artifacts that matter for each alert category, such as the same user, host, or sending domain, and checks whether an alert already belongs to an existing case before opening a new one.
Routing comes third. Teams write routing rules on the source tool, alert attributes, entities, and tags, and each alert goes to its outcome: investigate, sample, suppress, or escalate. Exceptions use the same rules. A rule for a VIP’s account or a known-good scanner sits alongside the defaults and takes precedence over them, and every routing decision is logged.
Our phishing report is routed to investigate. A user forwarded a message they thought looked wrong.
Minute zero: the agent takes the alert
When the alert arrives, an agent establishes what it is working with: the sender address and display name, the sending domain and its registration and hosting, any URLs in the body, any attachments and their hashes, the recipient, and the delivery time.
That is not analysis. The agent now has the hypotheses it needs to test: a legitimate email from a real supplier, a generic spam blast, a targeted credential phish, or a malware delivery.
A traditional SOAR playbook would now run a fixed sequence: sender reputation, attachment scan, known indicator lookup. 7AI’s agents start where the details of this message point, because those details determine which hypothesis resolves fastest.
Gathering context, in an order that depends on what it finds
The message claims to be from a supplier and contains a link to a document portal. The agent queries the domain and finds it was registered eleven days ago.
The fact reorders everything after it. A newly registered domain impersonating a known supplier moves this from probably-spam toward likely-targeted, so the agent asks who else received it rather than finishing the generic checklist.
It queries the email platform for other recipients of messages from that domain. Three other people got a version of it, all in finance.
It checks whether anyone clicked and finds that one of the finance recipients opened the portal link four minutes after delivery. The investigation moves to that employee’s account.
The agent queries the identity provider for sign-in events on that user and finds a successful authentication from an IP the user has never used, followed by an approved MFA prompt. Coming minutes after a click on a phishing link, that approval points to the attack itself. Modern phishing kits relay the login to the real identity provider, the user approves the prompt themselves, and the attacker walks away with a valid session from their own server. It queries thirty days of historical sign-in data to establish whether that IP is genuinely novel or merely infrequent. It queries the endpoint platform for process activity on the user’s laptop after the click, to test whether the link delivered malware as well as stealing credentials. The device is clean, which narrows this to credential theft. It checks whether any inbox rules were created on the account. In a supplier invoice scam, the attacker’s next move is a rule that automatically moves or deletes replies containing words like ‘invoice’ or ‘payment.’ The real user never sees the supplier asking why the bank details changed, which keeps the fraud running. The agent finds one, created twenty minutes after the suspicious sign-in.
Six sources (domain intelligence, the email platform, the identity provider, the SIEM, the endpoint platform, and mailbox configuration), queried in an order nobody specified in advance. A playbook could include every one of those queries, in an order someone wrote down in advance. The agent set its order from the evidence: the domain’s registration date made the recipient question more urgent than the attachment scan, and one click sent the investigation into identity and endpoint data.
How the agent knows it has gathered enough
Most AI SOC product descriptions answer this by saying the agent keeps going until it has enough evidence, which leaves the real question open: how much is enough? Three conditions determine whether an investigation stops at the right point.
Convergence of independent signals. One source confirming a hypothesis is weak. Three unrelated sources agreeing is strong, because an attacker would have had to manipulate all of them. Here, three independent signals line up: a sign-in from an IP the user has never used, an MFA approval minutes after a click on a phishing link, and an inbox rule created twenty minutes later to hide replies. Together, they make the compromise conclusion safe.
No unresolved contradictions. An investigation that stops with a signal still pointing the other way has not finished. Geolocation suggesting impossible travel is not a verdict when calendar data shows the user genuinely traveled. Resolve the contradiction or carry it into the output as stated uncertainty.
Diminishing returns on the next query. At some point, another query adds cost without changing the conclusion. Recognizing that boundary separates a bounded investigation from one that runs until a timeout.
When a contradiction remains after the agent has run every query that could resolve it, the agent escalates the case with the open question documented, so the analyst who picks it up starts where the agent stopped. When evaluating any AI SOC platform, ask how it reports these cases.
Reaching a verdict
The output is a determination with the reasoning behind it: the verdict, its severity, the specific findings that drove both, and the evidence behind each finding.
Each verdict leads to a clear next step. Suspicious activity escalates to the team with the full investigation attached. Likely benign activity closes, with the reasoning on record. The rare case the evidence cannot settle escalates as uncertain, so it reaches a person with the open question already defined.
Two kinds of context shape every investigation: facts about your environment, such as critical assets, VIP users, and policies, held as Enterprise Insights, and your team’s own investigation methods, written in plain language as Skills. When an alert arrives, 7AI matches both against the alert’s source and the entities involved, and keeps matching as the investigation discovers new users, hosts, and IPs. Matched Insights reach the agent as facts to weigh, and matched Skills as instructions for where to look and how to reason. Each investigation shows which Insights and Skills applied, so a team can see its own context at work.
For this alert: a credential phishing campaign targeting finance, with one confirmed compromise, one malicious inbox rule, and copies of the message still sitting in three other finance mailboxes. That whole sequence takes minutes. The worked example on our Investigations page walks through a similar investigation step by step.
What the finished investigation contains
Every finished investigation shows its work, so anyone on the team can see exactly how the agent reached its conclusion. That record has five parts.
- The summary: The determination first, with the reason behind it and every finding cited to the evidence behind it, whether that is an artifact or the query that surfaced it.
- The agentic report: Every step the agent took, with the tools it used, the exact query it issued, the response that came back, and what it concluded from that response.
- Remediation: Each proposed action tied to the artifact it addresses and the reason it is recommended, with a full audit trail of the actions taken.
- Artifacts: The emails, domains, files, hashes, and users the investigation touched, each one linked to its raw data.
- Ask: A way to ask follow-up questions about the investigation in plain language, answered from its evidence and from new queries against your connected tools.
Many AI SOC tools escalate a verdict on its own. A verdict with its full record attached is one your analysts can act on right away. A bare verdict gets reinvestigated, which is how teams pay for the same work twice.
Response, within limits set in advance
The conclusion becomes action: disable the compromised session, remove the malicious inbox rule, pull the message from the three other mailboxes, block the domain.
Which of those run automatically and which wait for approval is configured before any of it happens. Response turns each conclusion into recorded action, guided or automatic, and every action is tied to the artifact and the reason. Most teams start with approval on the actions that carry the most consequence and move them to automatic as they build trust in the results.
Why the reasoning has to be grounded
A language model asked to reason about security evidence will produce fluent output whether or not the evidence supports it. 7AI handles this in two ways: it grounds every agent in evidence from your environment, and it uses deterministic checks for every fact that has a single right answer.
Grounding means the agent reasons over retrieved evidence from your environment rather than over its training data. Every claim traces to a query that was issued and a response that came back.
Determinism means facts with a single right answer come from exact checks. Hash reputation, signature matching, allowlist membership, and policy checks each return a precise result, and the agent then reasons over those results together to work out what they mean for the case.
The agent handles interpretation, correlation, and planning. Deterministic components supply the facts it reasons over and enforce the decisions that must be exact.
When the agent gets it wrong
Any investigator, human or agent, will occasionally get a call wrong. What matters is how quickly the mistake surfaces and how the system learns from it.
Because every step is stored with its query and its result, a wrong verdict can be traced to the step where the reasoning went off. An analyst who disagrees can say so, and the team can turn that correction into a Skill or an Enterprise Insight, so similar cases follow the new guidance from then on.
Accuracy claims deserve the same scrutiny. Several vendors publish figures above 95%, and the SACR market landscape states plainly that no widely accepted benchmarks exist for evaluating agentic AI in SOC environments. That puts the weight on how a platform measures itself. 7AI runs engine changes through its own evaluators and regression tests, replaying past investigations to confirm verdicts hold as the engine evolves. For a buyer, the most useful test is a platform’s performance on your own historical alerts, scored against confirmed outcomes.
Four questions to ask when evaluating an AI SOC platform
- What share of alerts get a full investigation rather than being filtered, sampled, or suppressed, and what is the definition of full?
- Show me a closed case end-to-end. Every query issued, every response returned, the reasoning at each step.
- What happens when the evidence is ambiguous? Ask to see a case the platform returned as indeterminate, and what happened to it next.
- What is the accuracy number measured against? If the answer is your own analysts, it means consistency rather than correctness.
For underlying concepts, see our reference pages on what an AI SOC agent is and what agentic security is.
See an investigation run end to end.
Frequently asked questions
How do AI SOC agents investigate an alert?
When an alert arrives, an AI SOC agent establishes the entities involved and identifies the hypotheses it needs to test. It then queries the security tools already deployed in the environment, and each result determines the next question, so the investigation path takes shape as the evidence comes in. The agent produces a determination with the supporting evidence and reasoning attached.
How long does an agentic investigation take?
Minutes. A manual triage of the same alert typically takes an analyst 20 to 40 minutes. Published vendor figures cluster between one and ten minutes depending on how many sources the agent queries.
How many queries does an AI SOC agent run per investigation?
Very few vendors publish this. Additional queries improve accuracy up to the point where the evidence converges. Past that point, each one adds cost without changing the verdict.
How does an AI SOC agent know when it has enough evidence?
The reliable signals are convergence of independent sources on the same conclusion, absence of unresolved contradictions, and a next query that would not change the outcome. Where those conditions are not met, the correct behavior is escalation with documented uncertainty. Most vendors do not publish a stopping criterion at all.
Can an attacker manipulate an AI SOC agent's investigation?
They can try, and a well-designed platform plans for it. Attackers control the content of many log fields, including user agent strings, URIs, DNS queries, and attempted usernames, and instructions planted there can influence a model reading them as evidence. 7AI keeps the decisions that must be exact in deterministic checks, out of reach of text planted in a log field, and every conclusion the agent reaches traces back to the query and response behind it, so your team can see exactly which evidence it relied on.
How is this different from SOAR automation?
SOAR executes a workflow written in advance, in a fixed order, for scenarios someone anticipated. An agent chooses each next step from what it has already found, which lets it follow evidence into domains the original alert did not touch and handle alert types no playbook covers.
Can an analyst check the agent's work?
Yes, and that capability is the thing to evaluate hardest. A complete investigation record shows every step’s tools, the actual query issued, the actual response returned, and the conclusion drawn from it, so anyone can trace exactly how the verdict was reached.
Do AI SOC agents hallucinate?
A model reasoning without constraint can produce claims its evidence does not support. Grounding the agent in retrieved evidence from your own environment, requiring every assertion to trace to a query that was issued, and keeping computable decisions in deterministic components rather than in the model are the mechanisms that reduce it.
Does the agent take action on its own?
Only within limits configured in advance. Each organization decides which response actions run automatically and which require sign-off, and every action is recorded against the artifact it addresses with the reason it was taken.
What data sources does an AI SOC agent need?
At minimum, the sources that hold investigative evidence: identity, endpoint, email, cloud, and the SIEM. An agent can only reason about what it can query, so connector coverage sets the ceiling on what any investigation can conclude.
