How This Works
Your answers directly map to agent design decisions. Each question tells us what to build for a specific step of the SOC for AI agent. Remaining detail gets resolved in the design session (targeting July 8–10 with Kush's team).
Estimated time: ~10 minutes. 7 questions total.
These answers define the agent's steps — trigger, investigation logic, verdict model, and output destination.
What triggers a SOC for AI investigation? Is it a scheduled discovery scan across tenants, a real-time alert when a new AI tool is detected (e.g., CrowdStrike fires an event), a manual Jira ticket, or something else?
Defines Step 1 of the agent — same intake pattern as your SOC triage agent, but the trigger source may be different. This determines whether we build for event-driven or scheduled execution.
Once an AI tool is discovered, should the agent investigate each finding individually (like SOC triage — one finding → one investigation → one verdict), or produce a batch inventory first, then rank by risk? This decides the agent's core structure — whether we reuse your existing SOP-per-finding pattern or design a two-phase discovery → triage flow.
When your team discovers unauthorized AI usage in a client environment today, what's the investigation process? Walk us through the decision steps — what data do you pull, what do you check, and how do you determine severity and response.
This becomes the universal SOP for the SOC for AI agent (same role as the SOP your triage agent uses today). We'll structure it with the same SOP + skill file separation your team already uses.
What's the verdict taxonomy for AI discovery findings? For SOC triage you use True Positive (Malicious / Benign), False Positive, and Escalate to L2. What are the equivalent categories for AI governance? (e.g., Authorized / Unauthorized / Under Review / Policy Violation / Exempt / Escalate)
Defines the determination step in the triage agent's SOP. The verdict drives what action the agent takes — close as compliant, flag for review, or escalate for enforcement.
Where should findings land? Options we see: Jira ticket comment (same as SOC triage), a dedicated Jira project for AI governance, a SIEM dashboard in Chronicle, or a standalone report. What matches how your analysts and compliance teams would actually consume this?
Defines the formatter step and output target. Your SOC triage agent posts structured findings as Jira comments in wiki markup — SOC for AI may need a different destination or format depending on who consumes it.
We know your core stack. These two questions fill the gaps specific to AI discovery.
Your SOC triage agent queries Google SecOps / Chronicle, VirusTotal, and Jira via MCP tool servers. For AI discovery, we'll likely need an additional data source for SaaS-level AI usage (ChatGPT, Copilot, Claude, etc.) — the network/proxy layer that sees outbound traffic to AI services. Which CASB, SSE, or DLP platform is deployed across managed environments? (e.g., Netskope, Zscaler, Microsoft Purview, Cyberhaven)
Endpoint telemetry (CrowdStrike) catches locally-installed AI tools and agents. CASB/SSE catches browser-based and SaaS AI usage. Together they give full coverage. This is the one major integration gap we've identified.
Is any AI-specific telemetry already available from your existing platforms? Two candidates: CrowdStrike Shadow AI Discovery (detects 1,800+ AI apps including agents, LLM runtimes, and MCP servers) and Microsoft Agent 365 (GA May 2026; integrates with Defender, Purview, Entra, Intune). Are either active in managed environments today?
If these are already producing AI telemetry, the agent orchestrates what's there rather than building discovery from scratch. Changes the entire scope — from "build discovery" to "build triage and governance on top of existing discovery."
Boundaries that shape what we build first and where we build it.
For the initial proof of concept: which client tenant(s) should we target, and what does "done" look like? (e.g., "Run against the Sophie tenant, show me an inventory of all AI tools detected with risk classification" or "Demonstrate the full loop: discovery → investigation → verdict → Jira output on 3 real detections")
Defines the PoC acceptance criteria and scopes the first deployment. Your SOC triage agent was built per-client (Sophie, Naomi) — we'll follow the same pattern and need to know which client is the starting point.