TL;DR: Modern SOCs lose critical hours to manual enrichment, schema normalization, and cross-console investigation, while attackers move in seconds, according to SentinelOne. The practical shift is that AI triage and automated response only work when telemetry is standardized and enriched before analysts touch it.
At a glance
What this is: This analysis argues that agentic SOCs depend on clean, standardised telemetry before AI can produce useful triage or response.
Why it matters: It matters because SOC teams cannot gain machine-speed investigation or automation if analysts still spend most of their time normalising data and stitching tools together.
By the numbers:
- A customer with 500 GB/day SIEM entitlement can push 1 TB/day through the pipeline at no additional cost.
Context
A SOC data pipeline is the layer that turns raw logs, alerts, and telemetry into something analysts and automation can actually use. The governance gap is not a lack of tools, but a lack of standardisation, enrichment, and routing before the investigation starts.
This matters for identity and access programmes because identity provider, endpoint, cloud, and workload telemetry only becomes useful when it is normalised together. Without that upstream discipline, AI triage and analyst decision-making inherit the same noise, gaps, and inconsistent schemas that slow manual investigations.
The article frames a common problem in modern security operations: teams are trying to apply AI to data that still needs basic engineering work first. That starting position is typical, not exceptional, across many SOC environments.
Key questions
Q: What breaks when SOC telemetry is still fragmented at investigation time?
A: The investigation process breaks because analysts spend their time repairing data instead of interpreting it. Fragmented schemas, stale asset inventories, and missing context force manual enrichment before any meaningful judgment can happen. That delays triage, weakens automation, and makes AI outputs unreliable because the system is reasoning over incomplete inputs.
Q: Why does clean telemetry matter so much for agentic SOCs?
A: Clean telemetry matters because agentic workflows depend on standardised, enriched inputs to connect events, estimate blast radius, and recommend response. If the data is inconsistent, the agent may move faster, but it will still move on bad context. The real control is therefore upstream data quality, not downstream model speed.
Q: How do organisations know whether their security data pipeline is working?
A: They should track whether clean data reaches detections quickly and consistently, whether identity-related events remain searchable end to end, and whether AI or SIEM workflows make better decisions after pipeline changes. If these measures do not improve, the pipeline is still obscuring value.
Q: Should organisations allow autonomous SOC workflows before the data layer is clean?
A: No. Autonomous workflows should only run after telemetry is standardised, enriched, and governed, because automation amplifies whatever quality is already present. If the inputs are messy, the workflow will accelerate confusion and potentially trigger the wrong response. Human approval remains essential until the data foundation is reliable.
Technical breakdown
Why SOC telemetry breaks down before investigation begins
Modern SOCs fail upstream when alerts arrive as fragmented records from firewalls, cloud services, endpoint sensors, identity systems, and legacy tools. Each source uses different schemas, fidelity levels, and field names, so the analyst spends time reconciling timestamps, usernames, hashes, and asset context before any real judgment can happen. That manual synthesis is not investigation, it is data repair. AI systems face the same problem because models and automation cannot reason reliably over inconsistent inputs. The architectural issue is not the alert itself, but the lack of a clean data layer that converts raw telemetry into a common operational language.
Practical implication: Build the normalisation layer before expecting better triage, otherwise every downstream control inherits the same noise.
How clean telemetry changes detection and SIEM performance
A structured pipeline improves detection by standardising telemetry before it lands in the SIEM or investigation layer. That allows correlation, search, and enrichment to happen against a common format instead of forcing analysts to write one-off parsing logic during active incidents. It also lets high-value events be indexed for fast retrieval while lower-value logs are routed to cheaper storage. In practice, this is a data architecture decision as much as a security one: the cleaner the input, the more reliable the detection logic, the less time lost to query friction, and the lower the operational drag on analysts.
Practical implication: Treat pipeline design as part of the detection stack, not as a storage optimisation project.
Why agentic reasoning depends on structured inputs
Agentic reasoning layers can only be as accurate as the telemetry they ingest. When the underlying data is enriched with identity and asset context before the analyst sees it, the system can infer blast radius, connect low-signal events, and produce a useful investigative narrative. If the input is raw or inconsistent, the agent may still automate work, but it will automate confusion faster. That makes data quality a governance issue for autonomous SOC workflows, not just a technical preference. Human approval also remains necessary because automation can move at machine speed, but only if the workflow is operating on trustworthy context.
Practical implication: Require clean, enriched telemetry as a precondition for any autonomous investigation or response path.
NHI Mgmt Group analysis
Clean telemetry is now the real control plane for SOC automation. When analysts must manually enrich every alert, the organisation has not built a detection problem, it has built a data-governance problem. The practical consequence is that AI triage cannot be evaluated only on model quality, because the upstream data layer decides whether the model has anything trustworthy to work with. The practitioner conclusion is to govern telemetry quality as an operational security dependency.
Data normalisation is the missing prerequisite for agentic SOC design. Agentic workflows promise faster investigation, but they also depend on standard fields, consistent identity context, and structured event relationships. Without that foundation, automation becomes a multiplier for inconsistency rather than a multiplier for analyst judgement. The practitioner conclusion is to treat normalisation and enrichment as first-class architecture controls, not post-hoc tuning.
Identity telemetry is where SOC data quality becomes measurable. The article’s strongest governance signal is the intersection between SIEM operations and identity, because identity provider, asset, and endpoint context are what make an alert actionable. That is where NHIs, workloads, and human identities converge in practice. The practitioner conclusion is to ensure identity data is standardised before AI-driven response is allowed to depend on it.
Autonomous Security Intelligence only works when humans are moved up the decision stack. The article makes clear that automation is meant to remove administrative drag, not eliminate accountability. That means analysts should own policy, escalation, and approval boundaries while machines handle repetitive collection and routing. The practitioner conclusion is to define where machine-speed action stops and human judgment begins.
Agentic SOC maturity will be measured by time reclaimed from data wrangling. The decisive metric is not how much telemetry is collected, but how much of an analyst shift is still consumed by enrichment, parsing, and console-hopping. Organisations that reduce that burden will be able to convert more of the SOC into true investigation and response. The practitioner conclusion is to measure operating time spent on data repair, not just alert volume.
From our research library:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Agentic SOC maturity will be judged by how much analyst time is recovered from manual data repair. The practical signal is not more telemetry, but less time lost to console-hopping, schema mapping, and one-off enrichment before a decision can be made. Teams that cannot show that shift have not yet built a real agentic operating model.
Identity data has to be standardised before automation can trust it. The article’s strongest implication for practitioners is that identity provider, endpoint, and workload context must arrive in the same language as the rest of the telemetry pipeline. Without that, AI-driven response inherits the same blind spots that already slow investigations.
For practitioners
- Standardise telemetry before AI reaches it Align incoming logs, alerts, and identity context to a common schema so investigation starts with structured data rather than raw event fragments.
- Separate enrichment from manual triage Automate IP, hash, user, and asset enrichment upstream so analysts do not spend shift time copying values between consoles.
- Route logs by investigative value Index high-value security events for rapid search and send lower-priority operational data to cheaper storage tiers.
- Gate autonomous response with approval boundaries Define which AI triage outcomes can trigger no-code workflows automatically and which actions require human authorisation before execution.
- Measure analyst time lost to data repair Track how much of the investigation cycle is consumed by schema mapping, query rewriting, and console switching before any decision is reached.
Key takeaways
- SOC teams are not only fighting alert volume, they are fighting the time lost to data repair before investigation can begin.
- AI triage and autonomous response depend on structured, enriched telemetry, not on raw logs arriving from disconnected tools.
- Practitioners should treat telemetry normalisation, enrichment, and routing as core security controls, not as back-end plumbing.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS-01 — Data-at-Rest | The article centres on structured telemetry and data quality as a prerequisite for SOC detection. |
| DE.CM-01 — Networks and Network Services Monitored | The SOC pipeline is about continuous monitoring across multiple data sources and services. | |
| Recommendation — Standardise telemetry flows so SOC tooling can consume reliable data instead of fragmented event records. Align monitoring inputs so analysts can correlate network, endpoint, cloud, and identity signals faster. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | The article focuses on collecting, normalising, and routing events for investigation and response. |
| Recommendation — Define event logging requirements that support structured ingestion and downstream analysis. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The problem is fundamentally about turning logs into usable, governed security telemetry. |
| Recommendation — Centralise audit log handling so enrichment, retention, and search are consistent across sources. | ||
| MITRE ATT&CK | TA0007;TA0006 — Discovery; Credential Access | The article references attacker speed, lateral movement, and the need to detect hostile activity quickly. |
| Recommendation — Map telemetry gaps to discovery and credential-access behaviours so hunts focus on the fastest attacker paths. | ||
Key terms
- Telemetry Normalization: Telemetry normalization is the process of turning data from different security tools into a consistent format that can support one policy decision. It is essential when identity, endpoint, and asset systems all feed the same control plane, because conflicting data can otherwise create gaps or overblocking.
- SOC Data Pipeline: A SOC data pipeline is the ingestion and processing layer that prepares security telemetry for analysis, detection, and response. It typically handles enrichment, routing, filtering, and formatting so downstream tools can act on the data quickly and consistently.
- Agentic Reasoning: Agentic reasoning is the ability of a model to work through multi-step tasks that involve planning, state retention, and decision-making across tools or instructions. It is more operationally demanding than simple text generation because failures often appear as partial completion, wrong causality, or silent omission.
- Human-in-the-loop response: An incident response model in which a human analyst reviews, approves, or rejects AI-supported recommendations before action is taken. The model is designed to prevent machine output from becoming operationally final without scrutiny.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is the industry's only accredited NHI security programme and is designed for practitioners shaping identity, access, and automation governance.
Published by the NHIMG editorial team on July 22, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org