TechPrufer
Get started
Harvey
Harvey logoHarvey · Feature trail

Agentic Security Operations Center

3 posts · Mar 2026 – May 2026

What this trail covers

Harvey's Agentic Security Operations Center (SOC) is a persistent, agent-native system built around a world model of Harvey's threat surface. It continuously hunts, triages, investigates, authors detections, and learns from interactions, all gated by human review on production changes. The data layer is optimized with ClickHouse for high-volume telemetry ingestion and analysis, enabling faster agent iteration. The SOC operates in a round-the-clock model with daily reports, hourly alert triage, and a daily threat-watch workflow. This system has significantly increased detection coverage while decreasing alert volume through automated tuning and deep-dive investigations.

All Harvey trails
  1. Building an Agentic Security Operations Center | HarveyThis post details the architecture and implementation of Harvey's Agentic Security Operations Center (SOC). Key contributions include the concept of a 'security world model' built on a high-volume ClickHouse data layer, an MCP server for agent tool access, and a threat model system prompt. It outlines a four-phase agent pipeline for threat research and detection engineering, and describes continuous alert tuning workflows that have led to a 5.7x increase in coverage with a 95% reduction in alert space. The post emphasizes the importance of investing in the data layer before agents and highlights the productivity win of pairing humans with agents for judgment and tedium respectively.
  2. Your Data, Your Control: How Harvey Manages Customer DataThis post details how Harvey's infrastructure and data handling practices ensure customer data security, including zero data access, IaC, encryption (including BYOK), ephemeral processing, and continuous monitoring. It emphasizes that customer data is isolated, encrypted at rest and in transit, and deleted after a defined retention period. The system logs all access attempts for auditing and anomaly detection, validating principles of least privilege and isolation.