Agentic AI threat hunting in SOCs: are your controls keeping up?

TL;DR: Agentic AI can reduce SOC triage bottlenecks by querying Wazuh telemetry, correlating alerts, and assembling investigations from indexed events, according to Wazuh. The governance question is not whether agents can help, but whether their access, traceability, and human oversight are constrained tightly enough for security operations.

NHIMG editorial — based on content published by Wazuh: Agentic AI threat hunting with Wazuh

Questions worth separating out

Q: How should security teams govern AI use when users, APIs, and agents all generate different telemetry?

A: Start by separating the governance problem into distinct control domains.

Q: Why do AI agents increase identity and access risk in SOC workflows?

A: Because they can chain multiple calls, reuse context, and reach across telemetry sources faster than a human review cycle.

Q: What breaks when AI agent access is broader than the task it is trying to complete?

A: When agent access is broader than the task, the identity can touch systems, data, and tools that were never necessary for the work.

Practitioner guidance

• Define a dedicated identity for every AI agent Create separate service accounts for each agentic workflow, limit them to the exact APIs and indices required, and avoid sharing credentials across use cases.
• Constrain tool use to read-only investigation paths Allow only the minimum actions needed for hunting and correlation, then block write operations, response actions, and administrative functions unless a separate control is approved.
• Log every agent action with evidence provenance Record the prompt, tool call, returned data set, and final output for each investigation so analysts can reconstruct how the conclusion was reached.

What's in the full article

Wazuh's full blog post covers the operational detail this post intentionally leaves for the source:

• Step-by-step Wazuh policy, role, and user configuration for the agentic AI workflow
• Exact environment variables and installation commands used to stand up Ollama and Qwen3 locally
• Example investigation prompts for data exfiltration, remote code execution, and alert correlation
• Screenshots and interface steps for reviewing investigation outputs in the Wazuh dashboard

👉 Read Wazuh's full guide to agentic AI threat hunting in Wazuh →

Agentic AI threat hunting in SOCs: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →