11 AI agents powering every stage of security operations

This post details 11 specific AI agents that power different stages of the security operations alert lifecycle. It elaborates on the 'Device posture check' agent, which connects to endpoint and configuration management tools via Glean's MCP host to pull configuration and vulnerability data, correlating it with EDRs and management systems to flag noncompliant assets and remediation priorities. It also describes the 'Identify incident experts' agent, which uses Glean's enterprise graph to identify subject-matter experts based on historical post-mortems, tickets, and documentation. The 'Incident correlation' agent links alerts and tickets from systems like Jira, ServiceNow, and Slack to uncover root causes. The 'Open security-related tickets' agent pulls open tickets from Jira and ServiceNow, grouping them by asset, severity, or customer. The 'Security issue impact' agent analyzes telemetry, asset inventories, and historical ticket data to determine blast radius and business impact. The 'Incident response process' agent guides teams through approved playbooks or drafts tailored templates. The 'Incident response documentation' agent automates the creation of incident summaries, evidence logs, and post-incident reports by recording activity timelines and collaboration threads. Finally, the 'Post-mortem creation and containment' agent standardizes incident recovery by automating documentation and guiding containment steps.