From AI Assistance to Agentic Action: Advancing the SOC in Splunk Enterprise Security 8.6

The SOC Has a Speed Problem

Security teams are being asked to do something that feels impossible: keep up with attackers operating at machine speed while still relying on workflows built for humans.

Alerts keep piling up. Investigations take too many pivots. Detection engineering is still too manual. Response automation is powerful, but takes specialized expertise to build and maintain. And through all of it, analysts are expected to respond rapidly, accurately, consistently, and with enough evidence to trust the outcome.

That is why Splunk Enterprise Security 8.6 is a giant step forward. With ES 8.6, Splunk advances the Agentic SOC, bringing purpose-built AI capabilities directly into the security workflows teams already use every day.

This is not AI bolted on. It is AI embedded deeply into the work of the SOC: triage, investigation, detection authoring, malware analysis, automation, response, and governance. The goal is simple: help analysts spend less time on repetitive work and more time on the decisions that matter.

Trust Is a Foundational Pillar of the Agentic SOC

The Agentic SOC is about trusted delegation.

Humans still set intent. Humans still define procedures. Humans still approve high-impact actions. But AI can now help carry more of the operational load across the TDIR lifecycle, especially the high-volume work that slows teams down.

What Customers Can Do

Focus on Real Threats

Analysts need help separating signals from noise. ES 8.6 prioritizes and explains alerts so teams can focus on true positives faster. AI-assisted triage and malware analysis help reduce investigation time by surfacing what matters, explaining why it matters, and giving analysts a clearer context earlier in the workflow.

Build Detections Faster

Detection engineering should not be bottlenecked by manual authoring alone. With Detection Builder capabilities in ES 8.6, teams can create and refine detections faster, improve coverage, and support lower mean time to detect. This helps make detection engineering more accessible while keeping expert reviews and control in place.

Automate and Respond Faster

Automation is one of the fastest ways to reduce manual effort, but building playbooks can take time and specialized knowledge. ES 8.6 helps teams turn natural language automation ideas into tested response workflows. Guided response capabilities also help execute approved response actions from SOC-defined procedures, supporting lower mean time to respond and more consistent response.

Build Trust and Scale Adoption

AI adoption only works when teams trust the process. ES 8.6 helps convert standard operating procedures into response plans so actions stay governed, repeatable, and auditable. That means teams can expand AI-assisted workflows without losing visibility, control, or accountability.

Why This Matters

Attackers are not slowing down. AI is accelerating the speed and scale of attacks, and traditional SOC operations cannot keep up if every step depends on manual effort.

The answer is not to remove people from the SOC. The answer is to give them a better operating model.

The Agentic SOC helps teams scale human expertise by letting purpose-built AI assist with repeatable, high-volume work while analysts stay focused on judgment, validation, and response decisions. It is a practical path toward trusted autonomy: start with low risk workflows that can be safely accelerated, keep humans in control where risk is higher, and expand adoption as confidence grows.

With Splunk Enterprise Security 8.6, the SOC gets more than another set of AI features. It gets a more connected way to work.

Specifically, AI can help triage, investigate, build detections, analyze malware, automate response, and keep procedures governed and auditable.

And most importantly, analysts remain in control of the outcomes.

That is the promise of the Agentic SOC: not replacing defenders, but helping them defend at machine speed.

Availability

Agentic SOC capabilities in ES 8.6 are available across Splunk Enterprise Security editions depending on capability and deployment model. Detection Builder and SOP capabilities are available with ES Essentials, while triage, malware analysis, automation builder, and guided response capabilities are available with ES Premier. Splunk is also committed to bringing Agentic SOC capabilities to customer-managed deployments soon.