AI SOC Implementation Guide

An AI SOC replaces the analyst-per-alert model with an agent-per-finding model. Every finding is assigned to a software agent that walks a structured investigation procedure, produces a verdict with attached evidence, and either acts autonomously or routes to a human with a recommendation. The analyst's job shifts from clearing the queue to tuning the system.

This is not automation of existing SIEM workflows. The entity graph, per-entity behavioural baselines, and structured question sets are the foundation — without them, 'AI triage' is just faster false positives. The platform must be able to answer 'is this anomalous for this specific identity?' not just 'is this anomalous generally?'

ManySignal's five-agent architecture — detect, triage, investigate, respond, report — maps to the five stages of the SOC workflow. Each agent is independently configurable and operates within the autonomy ladder you define.

The detect agent continuously evaluates incoming events against streaming detections, correlation rules, and behavioural baselines. When a condition is met, it creates a finding and routes it to triage. Detection logic is code: YAML in git, tested via CI, promoted through staging.

The triage agent walks a question set per finding type, resolves each question against live data (graph, behavioural, enrichment, human confirmation), computes a confidence-weighted verdict, and either closes with rationale or escalates to investigate. The investigate agent enriches the case with entity graph traversal, related findings, timeline reconstruction, and threat-intel lookups.

The respond agent executes approved actions: isolate host, revoke session, disable account, block IP, create ticket. Every action is gated by the autonomy ladder — blast-radius limits are enforced per action class. The report agent generates structured outputs for weekly ops reviews, executive briefings, and compliance evidence packages.

The autonomy ladder has four rungs: recommend-only (agent suggests, human decides), approve-gated (agent acts with human click), supervised-autonomous (agent acts, human can veto within window), and fully-autonomous (agent acts immediately). Every new action class starts at recommend-only.

Promotion criteria are metric-driven: after 500 verdicts at a given rung, if TP precision exceeds the configured threshold, the team can vote to promote. Demotion is always available — one click drops an action class back to recommend-only without touching the rest of the ladder.

Blast-radius limits apply independently of the autonomy rung. A supervised-autonomous session revocation is still bounded: the agent cannot revoke more than N sessions per hour without a human approval. Limits are per-action-class, per-tenant, and configurable.

Every agent reasons over the entity graph. The graph is a property graph of identities, devices, applications, cloud resources, and network endpoints, linked by typed edges (authenticates_to, accesses, assumes_role, communicates_with). Each node carries a behavioural baseline built from rolling 90-day history.

When the triage agent asks 'is this login anomalous for this identity?', it queries the graph for that identity's historical ASN set, device set, session duration distribution, and concurrent session count. The answer is specific to that entity — not a population average.

Days 1–30: connectors deployed, entity graph populated, detect agent running in shadow. No analyst workflow changes yet. Goal: confirm coverage parity with existing tooling and let baselines stabilise.

Days 31–60: triage agent enabled in recommend-only. Analysts review recommendations alongside their normal queue. Track recommendation accuracy daily. Promote high-confidence finding types to approve-gated.

Days 61–90: investigate and respond agents enabled. At least three action classes at approve-gated or higher. Report agent producing weekly ops report. Target: 80%+ of alerts reaching autonomous or approve-gated verdict by day 90.

Five metrics define AI SOC health: autonomous verdict rate (target 90%+), median time to verdict (target under 4 minutes), TP:FP ratio per detection (target 20:1 for high-severity), cases escalated to human per week, and cost per verdict. Report all five weekly from day 1.

The report agent generates these automatically from the case timeline. The weekly ops report is a PDF or Slack digest — no analyst hours required to produce it. Executive dashboard shows 30-day trends for each metric.