Work with the agents, not around them.
The agents take the first look at everything and show every step. Your people make every call that matters. Pick a role to see where the work passes from one to the other.
A shift, with agents in it
When
The agents
You
-
Overnight
Triage reads every rule match and writes down why each one was kept or held back.
-
Related alerts join one case, and the investigation starts on its own, every answer from the logs.
-
The assessment: what changed, what it still can't say, how sure it is. Every claim links to its evidence.
- the case reaches you in Slack, Teams, PagerDuty or email
-
08:10
You open a case that's already built, and read how it got there.
-
08:25
You ask a follow-up in the Assistant: what did this process do?
- you ask
-
The forensics and malware specialists are brought in, and their findings land on the case.
-
09:00
You approve the next steps and set the verdict.
-
Monday
A new source arrives and LogSeam recognizes what's in it.
-
Rules are written for it and tested on your past logs.
- every rule waits, switched off
-
Tuesday
You read how each rule did on past logs.
-
You switch on the ones you trust. Nothing goes live until you do, and every rule shows who switched it on.
-
Thursday
The weekly hunt runs across every year of logs you keep, and its finding becomes a draft detection.
- a finding, for you to judge
-
You decide what the finding means, and whether the rule goes live.
-
Once
You write a task in plain language: every morning, check new intel against past logs.
- a standing order
-
Every day
The task runs on schedule, the same way every time.
-
Week one
You read what triage held back, and why, until you trust its calls.
-
You set the model for each kind of work, and see what each agent spends.
-
Month end
The report is written from the cases, rules and spend on the record.
- a draft, from the record
-
You decide what goes to the board.
Where the line sits
The agents, on their own
- Read every alert, around the clock, and say why.
- Build the case and investigate it on all of your logs.
- Write rules for your sources and test them on past logs.
- Run the tasks you wrote, on schedule.
Only your people
- Switch a rule on.
- Approve the next steps on a case.
- Set the verdict.
- Decide what goes to the board.