Intezer has announced Custom Agents, a new capability that lets security teams build their own AI agents directly inside the Intezer platform. The launch builds on Intezer’s core approach, that lets autonomous agents do the security work and humans supervise it.
Security teams can no longer rely on manual alert handling or one-off automation to keep up with the volume and complexity of modern threats. Intezer’s core platform already uses autonomous agents to triage, investigate, and respond to alerts around the clock, investigating 100 percent of alerts and escalating fewer than 2 percent for human review.
With Custom Agents, customers can now build on that foundation by automating any additional investigation work, report generation, and other recurring SOC routines unique to their environment.
Bringing automation to custom SOC activities
Every SOC has its own set of daily routines, from writing custom incident reports and sharing shift handoff notes to tuning detection rules and documenting investigation outcomes. After analyzing how teams used Intezer’s AI chat for these workflows, Intezer found that more than a third of conversations involved the same repetitive tasks being requested again and again. Custom Agents turn those tasks into agents that run on their own.
Existing Intezer customers use agents in production for a broad variety of tasks such as:
- Writing custom incident reports
- Recommendations on tuning rules based on triage verdicts
- Proactive threat hunting
“With Custom Agents, security teams can automate their unique individual and team processes, by building their own AI agents, which run on the same engine that operates their SOC to ensure seamless integration and performance,” said Itai Tevet, CEO of Intezer. “Our autonomous agents have long handled the fundamental work of the SOC. With Custom Agents, we are giving customers the power to automate their own unique workflows, running them precisely how they choose.”
Getting started with Custom Agents
Custom Agents are easily created using natural language. SOC teams describe what they want done, choose when it runs (i.e. on a schedule, on an event such as a closed case, or on demand), and pick the tools it can use.
Agents work across the stack, combining Intezer’s built-in toolset with connected SIEM, EDR, and identity tools including CrowdStrike, SentinelOne, Splunk, Microsoft Sentinel, and Entra ID. They take action by updating, commenting on, and closing cases and emailing finished reports.
