Notifications
Clear all
Topic starter
22/07/2026 4:34 pm
TL;DR: Modern SOCs lose critical hours to manual enrichment, schema normalization, and cross-console investigation, while attackers move in seconds, according to SentinelOne. The practical shift is that AI triage and automated response only work when telemetry is standardized and enriched before analysts touch it.
NHIMG editorial — based on content published by SentinelOne: Security Operations Centers are becoming agentic
By the numbers:
- With AI SIEM, organisations are already executing their queries 70% faster.
- A customer with 500 GB/day SIEM entitlement can push 1 TB/day through the pipeline at no additional cost.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams use AI in the SOC without losing human control?
A: Use AI to remove repetitive work, enrich alerts, and accelerate triage, but keep humans accountable for escalation, containment, and exception handling.
Q: Why do fragmented logs make AI security tools less reliable?
A: AI systems depend on structured, correlated data.
Q: What breaks when SOC teams skip identity enrichment?
A: Investigations lose the link between alerts and the actual user, workload, device, or service account involved.
Practitioner guidance
- Standardize telemetry before expanding AI use Define a minimum normalization layer for firewall, endpoint, identity provider, cloud, and asset data so investigations start from consistent fields rather than raw vendor formats.
- Enrich alerts with identity and asset context Attach user, workload, device, and ownership metadata at ingestion time so analysts and AI tools can resolve who or what an event actually relates to without manual pivoting.
- Set explicit boundaries for agentic response Allow automated investigation and containment only for preapproved workflows, with human authorization required for high-impact actions such as isolation, disablement, or access revocation.
What's in the full article
SentinelOne's full article covers the operational detail this post intentionally leaves for the source:
- How Singularity AI Data Pipelines normalize telemetry into OCSF and route logs for different storage and search tiers.
- How indexless AI SIEM workflows reduce query latency and change the investigative workflow for SOC teams.
- How Purple AI assembles blast-radius context and investigation summaries from clean telemetry.
- How Hyperautomation is governed with human approval steps for high-impact response actions.
👉 Read SentinelOne's analysis of agentic SOC data pipelines, AI SIEM, and response automation →
Agentic SOC data pipelines: what is changing for analysts now?
Explore further
22/07/2026 4:39 pm
Data quality is now a security control, not a back-office concern. SOCs that treat normalization, enrichment, and schema alignment as infrastructure housekeeping are underestimating their role in investigative speed and decision quality. The article correctly shows that AI cannot compensate for unusable telemetry, because garbage in still becomes garbage out. For practitioners, the governance lesson is to manage telemetry integrity with the same discipline used for identity and access context.
A question worth separating out:
Q: Who should approve autonomous response actions in an agentic SOC?
A: High-impact actions should be owned by the security function with clear operational accountability, and they should be restricted by policy rather than left to the model or the vendor. That includes isolating hosts, revoking access, or disabling services. The practical test is whether the action can be audited, justified, and reversed quickly if the AI decision was wrong.
👉 Read our full editorial: Agentic SOCs depend on clean data before AI can help
