A SOC deploys an AI tool that, without step-by-step prompting, pulls related logs, enriches indicators, decides whether an alert is benign, and closes or escalates the ticket on its own. Which AI capability is this, and what does it MOST require?
Select an answer to reveal the explanation.
Short Explanation
When the AI starts doing things on its own - pulling logs, deciding, closing tickets - you're looking at agentic AI. Something that acts by itself needs a leash: guardrails, limits, and a human checking its work. The trap is any choice that says 'no oversight needed.'
Full Explanation
Agentic AI refers to systems that pursue a goal by planning and executing multi-step actions with a degree of autonomy, invoking tools such as log queries, enrichment services, and ticketing APIs, and making decisions about what to do next. The described tool gathers evidence, makes a disposition, and closes or escalates tickets without step-by-step prompting, which is agentic behavior. Because it acts directly on security workflows, it requires guardrails such as limits on which actions it may take, approval steps for consequential ones, logging of its reasoning and actions, and periodic human review of its dispositions, especially auto-closed alerts. A chatbot responds to questions in conversation and does not independently execute workflows; in any case, chatbots also need oversight for accuracy. Predictive analysis forecasts trends or likely events from data; it does not act on tickets, and its forecasts still warrant validation. AI-augmented baselines learn normal behavior to support anomaly detection, but they do not eliminate the need for analyst review. Exam caveat: agentic systems can be manipulated through content they process, such as crafted log entries, so oversight is a security control, not a formality. Operational check: sample auto-closed tickets weekly and confirm analysts agree with the AI's dispositions.