TL;DR: Agentic security operations should start on telemetry rather than alerts, so AI can reconstruct investigations from raw events instead of inheriting whatever upstream tools chose to flag, according to Abstract Security. That shift changes SOC value from summarising noise to building end-to-end incident context, which makes event fidelity and data modelling the real control plane.
At a glance
What this is: Abstract Security says agentic SIEM should begin with events, not alerts, so investigations can be rebuilt from raw telemetry instead of whatever an upstream tool chose to flag.
Why it matters: For SOC teams, that changes the governing question from alert quality to event fidelity, normalization, and cross-source correlation across identity, cloud, and application data.
Context
Most SOC workflows still start after another product has already decided that something is worth flagging. That creates a structural dependency on upstream detection quality, which means missed detections stay invisible and noisy detections consume analyst time. In agentic security operations, the more important question is whether the underlying event stream is complete, normalized, and suitable for reconstruction.
This article sits at the intersection of SIEM operations, detection engineering, and identity-aware investigation. When an agentic system can correlate events across cloud, SaaS, network, and identity sources, the governance problem becomes how much trust to place in the telemetry model and how quickly analysts can recover a full timeline. That is a broader SOC design issue, not just a feature choice.
Key questions
Q: What breaks when SOC teams rely only on technical alerts and ignore human context?
A: When teams rely only on technical alerts, they often lose sight of why an event matters. The same alert can represent very different risk depending on the person, their access level, and recent behaviour. Without that context, SOCs miss patterns, mis-rank severity, and waste time on low-value investigations while real human-driven threats continue.
Q: Why do event-level correlations improve incident investigations?
A: Because incidents are temporal and relational, not single-point signals. Event-level correlation lets analysts connect identity, activity, and sequence across tools, which produces a defensible timeline and better blast-radius scoping. Without that layer, the SOC may know that something tripped, but not what happened before or after it.
Q: How should security teams decide what telemetry to collect in AI-driven environments?
A: They should collect telemetry based on the security, detection, and compliance decisions the data must support, not on source availability alone. That means defining required fields, retention needs, and enrichment points for each use case. If the data cannot support a specific action, it should not be ingested by default.
Q: Should organisations replace their SIEM to adopt agentic security operations?
A: Not necessarily. The article’s core architectural point is that composable blocks can be adopted one at a time if they share a common data model. That lets teams start with collection or pipeline cost, then expand into detection and orchestration once the underlying telemetry foundation is stable.
Technical breakdown
Why event-first detection changes the SIEM data model
Traditional SIEM workflows often treat alerts as the primary unit of work, with telemetry arriving only after some upstream rule, model, or signature has already filtered it. An event-first approach inverts that logic. The system normalizes raw telemetry in-stream, preserves context, and correlates across sources before deciding what matters. That matters because investigations depend on sequence, identity, and relationship data, not isolated triggers. If the underlying event model is weak, no amount of downstream automation can reconstruct a reliable incident narrative. In practice, event-first detection is less about more data and more about better data shape for correlation.
Practical implication: prioritize event normalization and schema consistency before expanding alert automation.
How an agentic orchestrator uses telemetry to build investigations
An orchestrator agent does not merely answer questions about alerts. It can query multiple sources, correlate identity and activity, enrich indicators, and assemble a timeline from raw events. That shifts the system from reactive triage to structured investigation. The important technical distinction is that the agent is making decisions over telemetry it can inspect directly, rather than over a pre-selected subset of detections. This also changes reliability requirements: the agent needs stable data access, accurate timestamps, and consistent entity resolution across tools such as cloud logs, SaaS activity, and identity sources.
Practical implication: ensure the AI layer can access source telemetry and entity resolution, not just alert summaries.
Composable SIEM architecture and the cost of shared data models
Composable security operations separate collection, detection, retention, and orchestration into blocks that can be adopted independently. That reduces forklift migration risk, but it only works when those blocks share a common data model. Without that, every integration becomes a translation problem, and every new capability carries an integration tax. The architectural question is therefore not whether the stack is modular, but whether telemetry retains meaning as it moves through the pipeline. For AI-driven operations, the shared model is what allows correlation, investigation, and automation to remain coherent across products and time.
Practical implication: treat the shared data model as an operational control, not a backend convenience.
Threat narrative
Attacker objective: The attacker objective is to move through the environment without depending on a single visible alert, while the defender objective is to reconstruct the full chain from telemetry before the incident is scoped too late.
- Entry begins in the telemetry pipeline, where the system ingests raw events alongside existing alerts from cloud, SaaS, identity, and network sources.
- Escalation occurs when the orchestrator correlates those events into a full account-takeover or exfiltration narrative that upstream alerting alone would not have assembled.
- Impact is a faster and more complete investigative outcome, including blast-radius scoping and plain-language reporting from the raw data trail.
Breaches seen in the wild
- Sumo Logic breach 2023: A compromised credential opened a Sumo Logic AWS account; customers were told to rotate API keys and stored credentials. No data impact was found.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Event fidelity is now a governance control, not just an engineering detail: if the SOC can only reason from alerts, it is always constrained by somebody else’s detection choice. That creates blind spots by design, especially across identity-rich systems where the most relevant signal is often the sequence of events rather than a single trigger. Practitioners should treat normalized telemetry quality as a first-order operational dependency.
Agentic SOC value comes from correlation, not summarization: the real shift is not that an AI layer writes nicer incident notes. It is that it can stitch identity, cloud, SaaS, and network events into an end-to-end case without waiting for a human to manually reconstruct the path. That makes cross-domain entity resolution a core SOC capability, not a back-office data problem.
Composable operations will win over rip-and-replace narratives: security teams do not modernize by replacing the entire SIEM stack in one move. The more realistic path is to adopt blocks that solve one constraint at a time, then expand once the shared data model proves stable. That approach validates incremental governance rather than forcing a platform bet.
Blast-radius scoping becomes the decisive SOC outcome: once the agent can see events directly, the differentiator is how quickly it can determine who or what was touched, not how quickly it can classify a generated alert. In identity-heavy environments, that makes event provenance and entity mapping the practical foundation for containment.
Abstract Security’s model reflects a wider shift in security operations architecture: the future SOC is less about counting alerts and more about preserving enough telemetry to let humans and machines explain what happened. That change matters because it moves operational confidence from detection volume to investigative completeness.
From our research library:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
What this signals
Event-first operations expose a governance gap that many SOCs have ignored: the team cannot automate what it cannot reconstruct. If raw telemetry is incomplete or inconsistent, agentic workflows become better at formatting uncertainty rather than reducing it, so the programme needs stronger data discipline before broader AI adoption.
The practical shift for defenders is to manage security operations as a telemetry problem first and an alerting problem second. That means identity resolution, source normalization, and sequence integrity become the controls that determine whether the SOC can actually explain an incident instead of merely acknowledging one.
For practitioners
- Standardize event normalization across core telemetry sources Define one canonical schema for cloud, SaaS, identity, and network events so investigations can be reconstructed without translation gaps.
- Measure alert dependence in investigation workflows Track how often analysts can resolve incidents only from alerts versus from direct event correlation, then identify the sources that break reconstruction.
- Test cross-source entity resolution for identity-rich cases Validate that the same user, workload, or account can be traced consistently across Okta, Salesforce, AWS, and network logs.
- Adopt composable security blocks before replacing the stack Start with the block that removes today’s bottleneck, then expand into detection, retention, and orchestration only after the shared model proves stable.
Key takeaways
- Alert-first SOC designs inherit whatever upstream systems decide to flag, which means they can miss activity that was visible in the raw data.
- Event-level correlation gives analysts a fuller incident timeline and better blast-radius scoping across identity, cloud, SaaS, and network sources.
- Teams that want agentic security operations should start by hardening telemetry quality and shared data models, not by adding another summarization layer.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CSA Cloud Controls Matrix and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0007; TA0009; TA0010 — Discovery; Collection; Exfiltration | The article’s attack reconstruction spans discovery, collection, and exfiltration from event telemetry. |
| Recommendation — Map reconstructed event chains to ATT&CK and tune detections for discovery, collection, and exfiltration patterns. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and Network Services Monitored | Event-first SOC operations depend on continuous monitoring of telemetry across networked services. |
| Recommendation — Use DE.CM-01 to verify that monitoring covers the event sources your SOC depends on. | ||
| CSA Cloud Controls Matrix | SEF — Security Event Management | The article is fundamentally about how event management supports detection and investigation workflows in the cloud stack. |
| Recommendation — Apply SEF controls to preserve event integrity and investigative usefulness across the security pipeline. | ||
| NIST AI RMF | MEASURE — AI Measurement and Analysis | AI SOC workflows need measurable telemetry quality before automated reasoning can be trusted. |
| Recommendation — Use MEASURE to assess whether the AI layer is operating on sufficient, reliable event data. | ||
Key terms
- Event-first security operations: An operating model where investigation and automation begin with raw telemetry rather than preselected alerts. The approach preserves context across sources so correlation, enrichment, and scoping can happen before a human or machine decides what is important.
- Telemetry Normalization: Telemetry normalization is the process of turning data from different security tools into a consistent format that can support one policy decision. It is essential when identity, endpoint, and asset systems all feed the same control plane, because conflicting data can otherwise create gaps or overblocking.
- Entity Resolution: Entity resolution is the process of determining which accounts, wallets, devices, or records belong to the same real-world actor. It is essential for sanctions and AML programmes because transaction data alone often hides related activity unless it is linked back to a trusted identity model.
- Composable Security: Composable security is a model where security functions are connected through APIs and integrations so they can share data and actions across tools. In practice, it lets identity, endpoint, cloud, and SOC controls exchange context quickly enough to support investigation and response workflows.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security for practitioners who need to connect identity controls to modern security operations. It is designed for teams that want a clearer operating model for access, trust, and automation across the wider security programme.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org