Sekoia Describes Multi-Level AI Agents for Multi-Tenant SOCs
Summary
Sekoia describes a multi-level agent model for MSSPs and large organisations: shared investigation standards are inherited from higher levels, while customer- or unit-specific context stays local to reduce duplication and cross-tenant confusion.
Key points
- MSSPs and large organisations need consistent investigation methods across environments that differ in normal activity, risk and procedures.
- Shared instructions, such as evidence standards and escalation processes, can be set centrally and inherited by lower-level agents.
- Customer- or business-unit-specific context can be added locally to help agents interpret alerts in the right environment.
- The model is intended to reduce duplicated configurations and drift when common instructions change.
- Sekoia says scoping instructions by organisational level can clarify ownership and help prevent one tenant’s context from influencing another’s investigations.
- The article presents agents as supporting analysts by making customer knowledge available during investigations, not replacing the analyst.
Article Details
- Event Type
- Description of multi-level agent customization in the Sekoia autonomous SOC platform
- Impact
- The platform allows shared investigation instructions to be defined centrally and customer- or business-unit-specific context to be added at lower levels. The article says this can reduce duplicated configuration, configuration drift, and the risk of local context influencing another tenant’s investigations; it does not report measured outcomes.