Notifications
Clear all
Topic starter
02/08/2026 9:38 am
TL;DR: Agentic AI can now execute real SOC investigations inside the security stack, logging actions, querying telemetry, and preparing containment steps while still requiring human approval for high-impact actions, according to LimaCharlie. That shifts the question from whether AI can assist analysts to how tightly its access, auditability, and guardrails are governed.
NHIMG editorial — based on content published by LimaCharlie: When Claude Code Hunts Cobalt Strike: Agentic Security Operations in Action
Questions worth separating out
Q: How should security teams govern AI-assisted actions in the SOC?
A: Security teams should treat AI-assisted SOC actions as policy-governed machine behavior, not informal automation.
Q: Why do agentic SOC workflows create IAM and PAM concerns?
A: Because the agents can take operational actions, not just recommend them.
Q: What do teams get wrong about autonomous AI in incident response?
A: They often assume autonomy is the goal.
Practitioner guidance
- Map AI agent privileges to specific SOC tasks Define separate entitlements for telemetry query, process enumeration, rule creation, and containment.
- Log every agent command and decision branch Preserve the exact queries, tool calls, timestamps, and intermediate outputs used during each investigation.
- Version-control AI instruction sets and runbooks Treat archived investigations, instruction files, and detection libraries as governed configuration.
What's in the full article
LimaCharlie’s full post covers the operational detail this analysis intentionally leaves for the source:
- Live investigation workflow details for Cobalt Strike hunting with Claude Code and the platform CLI
- The exact sequence of telemetry queries, process checks, and memory searches used during the demo
- How Viberails-style guardrails were applied to separate investigation from containment
- The platform-specific instruction set and archive pattern used to improve future investigations
👉 Read LimaCharlie’s analysis of agentic SecOps with Claude Code →
Claude Code in SecOps: are your investigation controls ready?
Explore further
02/08/2026 12:32 pm
Agentic SecOps creates a new identity governance problem, not just a new automation layer. When an AI agent can query telemetry, pivot across detections, and prepare containment steps, it is functioning as a governed non-human operator inside the security stack. That means entitlement boundaries, approval gates, and audit trails now apply to machine execution as much as they do to analysts. The practical conclusion is that SOC automation and NHI governance can no longer be run as separate programmes.
A question worth separating out:
Q: Who is accountable when an AI agent takes an unsafe action?
A: Accountability should sit with the business owner of the agent, the team that provisioned the access, and the control owners responsible for monitoring and revocation. If no one can answer who approved the identity, the scope, and the oversight model, the governance framework is not complete enough for production.
👉 Read our full editorial: Agentic security operations with Claude Code change SOC execution
