Delegate, Guide, Bound: How Splunk SOC Uses Agents

Most security teams know AI can help. Fewer have measured whether it actually does.

At Splunk, our Global Security Organization (GSO) runs the SOC that protects Splunk, and we serve as Customer Zero for Splunk's security products. In practice, that means three things. We direct product teams toward the problems most worth solving. We give transparent feedback on capabilities while they are still early. And we build our own solutions and agents to test against what ships natively in Splunk Enterprise Security. The goal is to raise the bar for the products our customers experience.

Putting agents to work across triage, detection engineering and automation changed how we think about deploying them. The useful question is not which role gets which agent. It is how much autonomy a given task warrants. In an agentic SOC, every analyst and engineer should be able to reach for any capability. What changes from task to task is how much the agent does on its own and how closely a person supervises it.

One Operating Model, Three Kinds of Autonomy

Some SOC work can be handed to an agent end to end. Some needs an agent working beside a person. And some carries enough impact that a human must stay in control of every decision. We organize our agentic work around those three modes:

• Delegated autonomy: High volume, repeatable work such as triage, enrichment, evidence gathering and routine disposition. The goal is to free analysts from noise.
• Guided autonomy: Work of variable complexity and high impact, such as investigation assistance, building automation and recommendations. The goal is to keep humans informed while the agent accelerates them. The agent works, the human steers.
• Bounded autonomy: High judgment, high impact work such as detection logic, response approvals and incident decisions. The goal is to keep humans in control. The agent drafts, the human approves before anything is committed.

These are modes of work, not job descriptions. The same analyst might delegate enrichment in the morning, build a connector with an agent at lunch and approve a new detection before the end of the day. Here is what each mode looks like in our SOC, and what we measured.

Delegated Autonomy: Fifteen Minutes to Under Six

Triage is where volume lives, so it is where delegation pays off first. We measured the Triage Agent on real SOC investigations, timing each ticket from the first analyst note to final disposition. Average handle time dropped from 15.4 minutes to 5.6 minutes, 64% faster and roughly 2.75 times the throughput.

Speed only matters if the verdicts hold up. Tested against production-like data in our SOC, the agent made zero misclassifications when classifying benign activity. Its first pass recognized test infrastructure, maintenance windows and benign automation, the kinds of alerts that consume analyst time without carrying real risk. When the evidence was not there, it said so and flagged the case as insufficient rather than guessing.

Delegation does not mean the analyst disappears. When a case does need a person, the analyst starts from the agent's summary as a working hypothesis instead of starting from zero.

Triage Agent is available with Splunk Enterprise Security Premier (cloud only), version 8.6 or higher

Guided Autonomy: From Days and Hours to One Session

Automation has long been gated by specialist skills. An analyst who knows exactly what a playbook should do often cannot build it, and a playbook that needs an integration that does not exist yet can stall for weeks. Guided agents close that gap. A person directs the work and makes the calls. The agent does the heavy lifting.

Building playbooks with Automation Builder

Automation Builder, available with Splunk Enterprise Security Essentials and Premier (cloud only) since version 8.6, helps you build, explain, edit, run and troubleshoot SOAR playbooks. It goes after playbook debt directly: datapaths, transforms and long sessions of debugging in the visual playbook editor. In a measured build, the agent produced an investigative phishing playbook in 8 minutes and 31 seconds, work that typically takes hours. For a full list of playbooks, connectors and custom functions required to successfully build your phishing investigation program see Advanced Phishing Response: An End-to-End, Automated Workflow

Building connectors with Connector Builder

When the action a playbook needs does not exist yet, Connector Builder generates it from an OpenAPI or Swagger specification, a Postman collection, an endpoint table or a plain English description. Hand-written connectors take days or weeks of Python development and testing, even with the Splunk SOAR SDK. With the agent, they take a single session. Connector Builder is generally available in Splunk Enterprise Security 8.7.

Who actually built the automation

This is where the case against role-based thinking is strongest. In our SOC, junior engineers created custom connectors for internal applications and extended existing connectors without having to navigate the intricacies of the Splunk SOAR SDK.

We also ran the Automation Games, a series of scored, competitive rounds in which members of our SOC at every experience level, deliberately including non-developers, built working playbooks with Automation Builder. Participants rated every agent response, and that feedback went straight back to the product team.

Bounded Autonomy: Two Hours to Under Ten Minutes

Detection logic shapes what a SOC can see, so a bad detection is expensive in both directions: missed threats or floods of noise. This is work where the agent drafts and a person decides.

Authoring a production detection by hand takes our engineers about two hours. Much of that effort goes into documentation as much as detection logic. Writing the SPL is only part of it; the rest goes to metadata: MITRE ATT&CK mapping, kill chain placement and ticket annotations. Coverage gaps stay open while community intelligence waits to be converted, and standards drift when every setting is applied by hand.

With Detection Builder, available with Splunk Enterprise Security Essentials and Premier (cloud only) since version 8.6, the engineer describes the behavior to detect, then reviews each suggestion and approves or rejects it. The agent drafts context-aware SPL, a title, a description and ATT&CK annotations. Authoring time dropped to under ten minutes, roughly 12 times faster. The agent completed 75% of tasks unaided and 90% after further prompting. In one case it migrated a live detection from the endpoint data model to EDR logs, querying real events to get the fields right. It also converts SIGMA rules straight into data model-based SPL.

Throughout, the engineer stays the approver. That boundary is the point.

Bounded autonomy is also where we see the next step. Agentic Workflow Builder lets automation engineers configure custom AI agents and place them directly inside playbooks, returning structured output that decision blocks can branch on. Instead of hard-coding judgment into branches or handing every decision to a person, teams can put an agent inside a governed workflow.*

What We Learned

Better response plans produce better verdicts

An agent is only as good as the procedure and context it is given. In triage, the factors that moved the needle most were the quality of the response plan and whether the context the agent needed was actually reachable. Investing in clear response plans paid off twice, once for analysts and again for agents.

Escalation is a feature, not a failure

Expect agents to escalate where judgment is fuzzy. Those escalations were not errors. They were the agent including a human in the loop instead of guessing. An agent that flags insufficient evidence earns trust faster than one that is always confident.

The skill floor matters more than the job title

When junior engineers can build connectors and non-developers can build playbooks, the line between "analyst" and "engineer" stops determining who can automate. Organizing around autonomy modes rather than roles let us put capabilities in front of everyone who could use them.

Trust, but verify

A second layer of review stayed in place across every mode. Delegated work gets spot-checked, guided work gets directed, and bounded work gets approved. Verification is what lets a SOC extend autonomy safely over time.

Put Agents to Work in Your SOC

Most of the capabilities described here are available with Splunk Enterprise Security Essentials and Premier tiers on Splunk Cloud. The agentic capabilities we use every day are the same ones available to Splunk customers. Explore the agentic capabilities in Splunk Enterprise Security to see how they can fit your SOC, and watch our .conf26 session, SEC1073: Supercharge Security Operations for the Agentic Era with Splunk Security, to see these agents in action.

^{*Under development. Agentic Workflow Builder is currently in alpha. Features and timing are subject to change.}