AI SOC Guide

RunReveal can run the first pass of your security operations for you. When a detection fires, RunReveal opens an investigation, an AI triage agent works the alert, and the case ends up either closed as a false positive or waiting for an analyst with the evidence already gathered.

This guide covers how that loop works, which investigation features the agent uses, the 11 steps the default triage agent follows, and how to turn it on. For the full reference on cases and artifacts, see Investigations.

How the loop works

Investigation features the AI SOC uses

Case fields

Every field below can be set by the agent or by an analyst.

Artifacts

The timeline is the audit trail for the case. It holds 11 artifact types.

Analysts add artifacts with Add to Investigation from Explore, alerts, AI Chat, and graphs. On the timeline you can star artifacts, filter by type, and search comments.

Indicators and IOC lookup

An indicator of compromise (IOC) is a concrete value tied to suspicious activity that you want to find again later, such as an IP address, username, domain, or file hash.

• Indicators are searchable across every investigation in the workspace. The type matches exactly and the value matches partially, case-insensitive.
• Results can be filtered by the earlier case's classification, so you can see whether the same value was a true positive or a false positive before.
• The triage agent runs this lookup before it writes its note. Note text is not searched, so anything you want found later belongs in an indicator.
• The default agent adds indicators only when it classifies a case true_positive, and only for values an analyst would pivot on.

How context reaches the agent

Add context before triage finishes if you want the first pass to use it. Notes added after a case is closed do not change that classification.

Time to respond

Each investigation shows four timing metrics in the sidebar:

Alert grouping

By default each alert gets its own investigation and its own agent run. For high-volume detections, Group alerts into one investigation opens one case per detection run instead, attaches every alert, and runs one triage pass that returns one classification for the set. Runs with more than 200 alerts are split into batches of up to 200, and no alerts are dropped.

The 11 default triage steps

When AI Triage is on and you use the Default Triage Agent, the agent follows these steps for each investigation.

Example: failed login attempts

This example follows one alert from a Multiple Failed Login Attempts detection with AI Triage on, the Default Triage Agent selected, and grouping off.

• Actor: [email protected]
• Source IP: 203.0.113.45
• What fired: 15 failed logins in the detection window
• Severity: high, from the detection

RunReveal opens Multiple Failed Login Attempts (a1b2c3d4) with the alert attached, and the agent works through the steps:

The analyst opens a case that already has the note, the query, the prior-case context, and two indicators. They block the IP, reset the password, and close the case with a resolution.

A triaged case looks like this. Here the agent classified a Kubernetes crash alert true_positive, judged it an operational issue rather than a security event, and closed it. The AI Triage Complete banner links to the agent's conversation. The summary, resolution, indicators, and timing metrics were all filled in by the agent.

The same steps on a false positive

Change one fact: the source IP is a vulnerability scanner that was classified false_positive in an earlier investigation.

• IOC lookup returns that earlier false positive, and the log query shows the IP on its usual scan schedule.
• The agent still writes its note, then classifies false_positive.
• It adds no indicators and closes the investigation.

No one needs to act unless the note is wrong. If the same benign pattern keeps firing, tune the detection.

Turn on AI triage

To give the agent detection-specific guidance, such as which logs to check, add it to the detection's notes. Those notes are added to the triage prompt for every alert from that detection.

Using past alerts in triage

The default agent is told not to search for or link other alerts, so past alerts on the same user or IP are not part of its analysis. History reaches it only through indicators on earlier investigations and through the logs it queries.

A custom agent can look at past alerts:

1. In Agents, create an agent and turn on Disable the RunReveal system prompt. The agent then receives only the alert and investigation IDs plus your prompt, so your prompt has to cover classification and closing the case itself.
2. Give it the Investigation Get, Add Investigation Artifact, Logs Query V3, List Tables, and Get Table Schema tools.
3. In the prompt, tell it to query the alerts table for the same actor or IP, for example:

SELECT createdAt, detectionName, severity, actor['email'] AS actorEmail, srcIP
FROM alerts
WHERE createdAt >= now() - INTERVAL 30 DAY
  AND (srcIP = '203.0.113.45' OR actor['email'] = '[email protected]')
ORDER BY createdAt DESC
LIMIT 50

4. Select that agent under Agent Configuration on the detection.

What the analyst still owns

A good way to start is with one noisy detection: turn on AI Triage, read the notes the agent writes for a week, and adjust the detection notes or agent prompt from there.

Related Documentation

• Investigations - Full reference for investigation fields, artifacts, indicators, and automated triage
• Agents - Create custom agents for triage and scheduled work
• Quick Start: Detections, Signals, and Alerts - Build the detections that feed the AI SOC
• Detection as Code - Set autoTriage, groupAlerts, and detection notes in code