Agentic Investigations
Understand and respond to active security incidents faster with the help an integrated SOC Investigation Agent
Status: Preview
Agentic Investigations is currently in Preview. Capabilities, outputs, response speed, and availability may change before general availability.
What is Agentic Investigations?
Agentic Investigations helps analysts understand and respond to active security incidents faster by turning incident data into a clear, plain-language investigation narrative.
Security investigations often require analysts to manually connect detections, entities, timelines, metadata, network activity, identity activity, cloud activity, and related evidence. Agentic Investigations reduces that manual effort by summarizing what happened, explaining why it matters, recommending next best actions, and guiding deeper investigation.
When enabled, analysts can use Agentic Investigations from a host or account page in the Vectra AI product experience.
Agentic Investigations uses generative AI models and Vectra AI-built agentic workflows to generate investigation summaries, explanations, and recommended next steps.
Why use Agentic Investigations?
Agentic Investigations is designed to help security teams:
Understand incidents faster
Reduce manual evidence gathering
Augment analysts with a Vectra AI investigation agent
Identify relevant context across hosts, accounts, detections, and activity
Prioritize the next best investigative steps
Accelerate response while keeping analysts in control
How do I enable it?
Agentic Investigations is available in the new Vectra AI experience, RUX, for customers on the Vectra AI Pro Platform or customers with 14 days of metadata retention.
An administrator must provide consent before the feature can be used.
How is data handled?
What data is involved?
Agentic Investigations uses incident-relevant data available in the Vectra AI Platform to generate investigation summaries, explanations, and recommended next steps.
Incident-revelant data may include, detections, hosts context, account context, metadata and query content and relevant context available in the Vectra AI Platform.
Customer data is processed for the purpose of generating Agentic Investigations outputs.
Will third-party generative AI models be trained on my data?
Customer data is not used to train third-party generative AI models or stored beyond what is needed for operational purposes.
Logs related to Agentic Investigations are retained by Vectra AI for 30 days. Vectra AI may uses these logs to troubleshoot problems, monitor quality, support reliability, and improve the product.
Where is data processed?
Agentic Investigations maintains data within the appropriate geographic boundary (US, EU, AP), but requests may require processing in a different cloud region (AWS Region) than the region where customer data is primarily hosted. Vectra AI makes every effort to handle customer data within the appropriate geographic boundary. Some cross-region inference processing may occur as described below.
United States
May be processed across supported AWS Regions within the United States
European Union
May be processed across supported AWS Regions within the European Union
Canada
May be processed across supported AWS Regions within the United States
Switzerland
May be processed across supported AWS Regions within the European Union
Australia
May be processed across supported AWS Regions within the Asia Pacific
Vectra AI implements appropriate technical and legal safeguards and complies with applicable data protection laws. Cross-region and cross-border transfers are encrypted and logged for compliance purposes.
Usage guidance
Agentic Investigations uses custom-built Vectra AI agents that leverage advanced foundation models and agentic workflows. Because generative AI is probabilistic, summaries, explanations, and recommendations may vary.
Analysts should review the investigation output, validate the supporting context, and use their judgment before taking response actions. Agentic Investigations is intended to accelerate investigation and response while keeping analysts responsible for final decisions.
Preview considerations
During Preview, customers should expect ongoing improvements to the quality, consistency, speed, supported investigation paths, and user experience of Agentic Investigations.
Vectra AI recommends that customers use Agentic Investigations as an investigation accelerator, validate outputs against available evidence, and provide feedback to help improve the feature before general availability.
Last updated
Was this helpful?