AI for SOC analysts, with the evidence attached

SOC work is full of the same first steps: which host, which user, which process, what changed, since when. An agent can take those steps across many hosts at once. What makes it usable in a SOC is not the speed; it is that every finding can be checked.

What the agent does in an investigation

1. The analyst asks a question or pastes an alert: for example, investigate this suspicious login on these three servers.
2. The agent chooses the triage skills that fit and runs their commands on the hosts in scope.
3. It returns findings per host, each with the command, its exit code and its output.
4. The analyst decides what happens next. Any change is a separate, controlled step.

Host investigations show the commands that ran, their exit codes and output, per host.

Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.

Why evidence matters more than the answer

Language models can be wrong with confidence. In a SOC, a wrong finding is worse than none. Showing the exact commands and output turns the agent’s answer into something an analyst can verify in seconds and a reviewer can audit later.

Skills: what the agent is allowed to run

Each skill says what it may and may not do, which tools it uses and which paths it may read, so your team can review it like any other tool before it reaches production.

Each skill is a versioned package. Uploads are checked before they install, every version is archived, and each workspace enables or disables each skill.

Skills ship with the release, come from AcTree's signed skill catalogue, or are your own uploads, and each workspace enables or disables each one.

Keeping the agent inside your SOC’s controls

Customer-hosted installations support an identity provider through OIDC with PKCE. Hosted workspace SSO must be confirmed for the agreed deployment.

Changing a host's execution policy from read-only to full is an administrator-only action.

Administrative actions — such as raising a host's execution policy or moving a host between workspaces — are recorded to an audit log with the actor, the action, the subject and the values before and after the change.

Architecture for a SOC

The platform runs on your infrastructure and the hosts under investigation are enrolled into it. The model runs where you choose, including on your own GPUs, so alert data and host output stay inside the boundary. See on-premise AI agents for the components.

Customer-controlled inference and execution boundaries.

Where to start

• Pick a set of recent, closed incidents and ask the agent the same questions your analysts asked.
• Compare its evidence with what the analysts found.
• Try the leaver-access check: accounts that still exist on servers after someone left.

The security investigation and leaver-access films in the use-case library show both, with sample data. The cybersecurity solution page lists the agents for a security team.