+ })
+SOC Analyst Agent
+Triage insights faster with evidence-backed verdicts from the SOC Analyst agent.
+})
+
+#### Insight investigation in Mobot
+
+When you select the **Ask Mobot** button on the new **AI Investigation** tab in Cloud SIEM, the insight's AI-generated information is launched in Sumo Logic Mobot. There you can use Mobot's focused query capabilities to drill down into the insight for greater detail.
+
+})
+
+#### SOC Analyst Settings
+
+The new **SOC Analyst Settings** tab on the **Cloud SIEM Workflow Configuration** page lets administrators control how the agent consumes your committed monthly investigation volume. Define an **Auto-Investigation Filter** to exclude low-priority insights from automatic investigation, and use **Volume & Overage Settings** to choose whether investigation continues past your committed volume. [Learn more](/docs/cse/get-started-with-cloud-siem/soc-analyst-agent#configure-soc-analyst-agent-settings).
+
+})
+
diff --git a/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md b/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md
index 08a8cbbdf1..79d1734d8a 100644
--- a/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md
+++ b/docs/cse/get-started-with-cloud-siem/about-cse-insight-ui.md
@@ -156,7 +156,7 @@ From the [Heads Up Display](/docs/cse/get-started-with-cloud-siem/cse-heads-up-d
### Overview
The **Overview** tab provides panels that give an overview of the insight:
-* **AI Analysis**. A concise, actionable summary of threat incidents based on triggered signals. It consolidates key details to facilitate quick understanding and response by security teams. The summary is generated by Sumo Logic's Dojo AI Summary Agent, an agentic AI tool. The summary is generated when an insight is created, and is regenerated whenever the insight is modified, keeping it current with added or removed signals. Summaries are not only generated for insights created by the system, but also custom insights created manually by users via the UI.
+* **AI Analysis**. A concise, actionable summary of threat incidents based on triggered signals. It consolidates key details to facilitate quick understanding and response by security teams. The summary is generated by Sumo Logic's [SOC Analyst agent](/docs/cse/get-started-with-cloud-siem/soc-analyst-agent) tool. The summary is generated when an insight is created, and is regenerated whenever the insight is modified, keeping it current with added or removed signals. Summaries are not only generated for insights created by the system, but also custom insights created manually by users via the UI.
:::note
Help us refine the tool by using the thumbs-up or thumbs-down buttons to provide feedback on the effectiveness of the summary presented. Clicking the thumbs-down button gives you the opportunity to provide additional feedback.
:::
diff --git a/docs/cse/get-started-with-cloud-siem/index.md b/docs/cse/get-started-with-cloud-siem/index.md
index 028cd27702..07adcab4a1 100644
--- a/docs/cse/get-started-with-cloud-siem/index.md
+++ b/docs/cse/get-started-with-cloud-siem/index.md
@@ -50,6 +50,12 @@ This guide helps you get started using Cloud SIEM for threat hunting.
Learn how the insight summary pane uses AI to provide summaries of threat incidents.
+Triage insights faster with evidence-backed verdicts from the SOC Analyst agent.
+}){kind=icon}
Get up and running quickly with Cloud SIEM administrator tasks.
})
+
+{/* VERIFY before publishing (DOCS-1565): confirm the 90-day window start and the exact opt-out mechanism. Source: Dojo AI FAQ, SOC Analyst Agent section. */}
+
+{/* TODO (DOCS-1565): Confirm the AI features toggle coupling with a PM. Is it one combined toggle that disables Mobot, Parse Assist, AND the SOC Analyst Agent together, or can the SOC Analyst Agent be disabled independently? Mirrors the same open question in docs/search/mobot.md (Opting out). Not PM-confirmed. */}
+
+
-The SOC Analyst Agent runs in the background against all insights that flow into Cloud SIEM. After analysis, it renders a verdict about whether the insight requires investigation.
-1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM > Insights**. You can also click **Go To...** at the top of the screen and select **Insights**. })
-1. Click **Start typing here to create a filter** near the top of the insights page and select **AI Verdict** to search for insights based on the verdict they are assigned:
+## View AI verdicts on insights
+
+The SOC Analyst agent runs in the background against all insights that flow into Cloud SIEM. After analysis, it renders a verdict about whether the insight requires investigation.
+
+1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM > Insights**. You can also click **Go To...** at the top of the screen and select **Insights**.
+1. Click **Start typing here to create a filter** near the top of the insights page and select **AI Verdict** to search for insights based on the verdict they are assigned:})
* **Malicious**. AI analysis determined that the insight is malicious, and warrants immediate investigation by your SOC team.
- * **Suspicious**. AI analysis determined that the insight is suspicious and warrants investigation by your SOC team.
+ * **Suspicious**. AI analysis determined that the insight is suspicious and warrants investigation by your SOC team.
* **Benign**. AI analysis determined that the insight is harmless and is not a candidate for elevation to SOC team investigation.
* **In Progress**. AI analysis is in progress.
* **Inconclusive**. AI analysis could not determine whether the insight needs to be investigated.
- * **Not Investigated**. No AI analysis was performed on the insight because of rate limiting rules. These rules control how many insights can be automatically processed to generate AI verdicts. Insights that have not been investigated display an **Investigate** button at the top of the insight details page. Click this button to manually initiate an AI investigation. For more information about rate limiting and its role in ensuring system stability, see [FAQs for preview](#faqs-for-preview) below.
+ * **Not Investigated**. No AI analysis was performed on the insight due to rate limiting. Click the **Investigate** button at the top of the insight's details page to manually initiate an AI investigation. See [How does investigation rate limiting work?](#how-does-investigation-rate-limiting-work) for details.
1. Clicking anywhere on the row of an insight that has an AI verdict shows a side panel with results of the verdict. This allows you to browse quickly for insights needing more investigation:})
1. To investigate an insight further, click the insight's ID. Insights with an AI verdict display an **AI Investigation** tab in the insight details page. Use the information on this tab to dive deeper into the insight.
@@ -48,43 +59,46 @@ The SOC Analyst Agent runs in the background against all insights that flow into
The **AI Investigation** tab in the details page of a Cloud SIEM insight is an artificial intelligence-generated analysis of the insight. Use the information on this tab to guide your investigation.
-1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Cloud SIEM > Insights**. You can also click **Go To...** at the top of the screen and select **Insights**. })
+1. The **AI Investigation** tab shows results of AI analysis:
1. **Severity Verdict**. Details about the insight's severity analysis:
* **Current Severity**. The severity of the insight as set by the cumulative activity score for the insight. For more information, see [About insight severity](/docs/cse/get-started-with-cloud-siem/insight-generation-process/#about-insight-severity).
* **Global Confidence Score**. A level of confidence that the insight is actionable, predicted by Sumo Logic’s Global Intelligence machine learning model. See [What is a Global Confidence score?](/docs/cse/records-signals-entities-insights/global-intelligence-security-insights/#what-is-a-global-confidence-score).
* **AI Verdict**. The AI system's qualitative assessment of the insight.
* **Recommends security level of ___**. AI analysis recommends a new severity level be assigned to this insight. If you agree with the assessment, click **Accept**. The **Current Severity** field changes to the new value.
- 1. **What Happened**. A concise summary of threat incidents based on triggered signals in the insight. Content of this field is generated by Sumo Logic's Summary Agent, an agentic AI tool. The summary consolidates key details to facilitate quick understanding and response by security teams. The summary is generated when an insight is created, and is regenerated whenever the insight is modified, keeping it current with added or removed signals.
+ 1. **What Happened**. A concise summary of threat incidents based on triggered signals in the insight, generated by the SOC Analyst agent. The summary consolidates key details to facilitate quick understanding and response by security teams. The summary is generated when an insight is created, and is regenerated whenever the insight is modified, keeping it current with added or removed signals.
:::tip
Help us refine the tool by using the thumbs-up or thumbs-down buttons to provide feedback on the effectiveness of the summary presented. Clicking the thumbs-down button gives you the opportunity to provide additional feedback.
:::
-
+ 1. **Recommended Actions**. Actions you can take to remediate the incident.
+ 1. Click **Execute Action** to run a [playbook](/docs/platform-services/automation-service/playbooks/) to take the recommended action:})
+ 1. Click **View Details** on the confirmation to see details about the playbook automation, and then you should see a confirmation:})
})
+ :::note
+ To be able to run playbooks from **Recommended Actions**, the integrations that the playbooks use must be properly configured. See [Configure Authentication for Automation Integrations](/docs/platform-services/automation-service/configure-authentication-for-integrations/).
+ :::
1. **Key Findings**. The main points uncovered by AI analysis. Details about these findings can be found in the signals that fired for the insight.
-1. Click **Ask Mobot** to send the AI analysis of the insight to [Sumo Logic Mobot](#investigate-the-insight-in-mobot) for further investigation.
-
-### Investigate the insight in Mobot
-
-1. From the insight's details page, click **Ask Mobot** to open the AI investigation in [Sumo Logic Mobot](/docs/search/mobot/).})
-1. Details about the AI investigation appear in Mobot. The entire context of the AI investigation is brought into Mobot so you can quickly drill down for more information about the insight. For example, under each step in **Key Findings**, you can click the provided links to see more details.
-1. In **Ask Something...**, type a question about the insight using details provided in the **What Happened** or **Key Findings** sections above. For example, you could ask to see logs about the entities mentioned in the text (that is, hosts, users, IP addresses, file hashes, and so on). You could even ask more general questions, like "Help me investigate this insight". })
-1. Click **Search** }){kind=small}
. Mobot analyzes your request and fashions a query based on it.
-1. Click **View Results** to see the results of your request in the logs query UI. You can also click the suggestions provided to drill down farther. As you ask questions, Mobot retains the context of your conversation about the insight, allowing you to more easily obtain detail. })
+1. Click **Ask Mobot** to continue the investigation conversationally in [Mobot](#investigate-the-insight-in-mobot), with the full context of the AI analysis already loaded.
+
+## Investigate the insight in Mobot
+
+Follow these steps once you're in Mobot:
+
+1. From the insight's **Details** page, click **Ask Mobot** to open the investigation in [Mobot](/docs/search/mobot/), Dojo AI's chat interface.
+1. The full AI investigation appears in Mobot. For example, under each step in **Key Findings**, you can click the provided links to see more details.
+1. In **Ask Something...**, type a question about the insight using details provided in the **What Happened** or **Key Findings** sections above. For example, you could ask to see logs about the entities mentioned in the text (that is, hosts, users, IP addresses, file hashes, and so on). You could even ask more general questions, like `Help me investigate this insight`.
+1. After executing a prompt like the one above, Mobot analyzes your request and fashions a log search query based on it.
+1. Click the log search results card to see the results of your request in the Log Search UI. You can also click the suggestions provided to drill down farther. As you ask questions, Mobot retains the context of your conversation about the insight, allowing you to more easily obtain detail.
1. As you work with the investigation agent, after each step you will be presented with follow-up questions. Type a number corresponding to a follow-up question, or enter your own question.})
+At any point during the investigation, click **Open Insight** to return to the insight's **Details** page in Cloud SIEM.})
+
### Search for related insights
During a Mobot investigation, you can search for other insights related to the current one. Mobot offers several dimensions to search by, helping you surface lateral context without leaving the investigation.
-Click **Search related insights?** when it appears as a suggested action in Mobot, or ask Mobot directly (for example, "Search for related insights"). Mobot will ask which dimension to explore:})
+Click **Search related insights?** when it appears as a suggested action in Mobot, or ask Mobot directly (for example, `Search for related insights`). Mobot will ask which dimension to explore:
* **Same entity**. Other insights involving the same user, IP address, or host.
* **Same attack name**. Other insights with the same attack name.
@@ -94,10 +108,7 @@ Click **Search related insights?** when it appears as a suggested action in Mobo
Select a dimension to proceed, or enter your own search criteria.
-### Start a new investigation
-
-To clear the context and start a new investigation, click **New Conversation** at the top of the screen. To start investigation on another insight, navigate back to Cloud SIEM, select another insight, and click **Ask Mobot**.
-
+
### Example questions
Following are example questions you could try in the **Ask Something...** field:
@@ -109,94 +120,110 @@ Although these are general questions, they give you an idea of the wide variety
### Generate dashboards
-To generate dashboards based on the context of your investigation, simply ask Mobot. For example, in the **Ask Something...** field you could type `Create a dashboard with the results of this investigation`. The agent will build the dashboard:})
+To generate dashboards based on the context of your investigation, simply ask Mobot. For example, in the **Ask Something...** field, you could type `Create a dashboard with the results of this investigation`. The agent will build the dashboard:
Click the provided link to view the dashboard:})
-## Add a comment to an insight
+### Start a new investigation
-You can ask Mobot to add a comment to the current insight. In the **Ask Something...** field, enter a prompt such as `Add a comment that I found a suspicious IP address` and press **Enter**. Mobot posts the comment to the insight's comment section.})
+To start a new investigation, navigate back to Cloud SIEM, select another insight, and click **Ask Mobot**. To clear your current session instead, see [New conversation](/docs/search/mobot/#new-conversation).
-Comments are visible to all analysts with access to the insight and can be used to document findings, note investigation status, or flag items for follow-up.
+### Share the conversation
-## Close an insight
+To share the current investigation with other users, see [Share conversation](/docs/search/mobot).
-You can also ask Mobot to close the current insight. In the **Ask Something...** field, enter a prompt such as `Close this insight` or `Mark this insight as resolved` and press **Enter**. Mobot closes the insight directly from the investigation area.
+
-## FAQs
+## Configure SOC Analyst Agent settings
-
+1. For the operator, select **equals** or **does not equal**.
+1. Combine conditions with **OR** and **AND**:
+ * Click **+ OR** to add a condition to a group. An insight matches the group when any condition in it is true.
+ * Click **+ AND** to add another group. An insight matches the filter only when every group is true.
-})
+
+After changing this setting, click **Save Settings** to apply your changes, or **Cancel** to discard them.
+
+
+
+## FAQ
+
+### What is the Sumo Logic SOC Analyst agent?
-### FAQs for preview
+The SOC Analyst agent is part of the [Sumo Logic Dojo AI](/docs/get-started/ai-machine-learning/#dojo-ai). The SOC Analyst agent is an assistant that applies agentic AI reasoning to triage and investigation tasks. It correlates alerts, weighs patterns against frameworks like MITRE ATT&CK, and renders evidence-backed verdicts, providing analysts an immediate sense of threat impact. When deeper analysis is required, you continue the same investigation conversationally in [Mobot](/docs/search/mobot/), Dojo AI's chat interface, to map relationships, connect entities, and summarize findings.
-