Logpresso Proposes AI Platform for Security Operations

Logpresso has proposed AIP, an AI agent platform for automating security operations. As AI-enabled cyberattacks become more sophisticated and faster, security teams must sift through ongoing alerts to identify real threats and decide how to respond. Organizations with too few specialists may struggle to maintain the same level of monitoring overnight and on holidays, while manual investigation and response after detection take longer.

AIP connects data collection, analysis, detection, response, and reporting through Logpresso’s SIEM, SOAR, and XDR platforms. It supports SOC (security operations center) workflows that query logs, compare information from multiple security products, assess whether an attack is underway, and record actions and their rationale. An agentic SOC analyzes logs from different systems and uses MITRE ATT&CK tactics and techniques to understand the context of threats.

Taking into account that time can pass between detecting a threat and a staff member reviewing it and responding—as with ARTEX, which was used in attacks on financial firms—AIP agents begin an automated investigation when they detect a threat. They analyze relevant data and key issues, record evidence and findings, and prepare initial response actions. Staff can review the analysis and its rationale in a messaging app and approve a response, allowing them to act overnight or on holidays without being at a console.

Logpresso also provides a builder for designing agents to fit an organization’s environment and policies. Users can set each agent’s role, instructions, query commands, skills, and workflow, and assign sub-agents to work with it. Agents can divide responsibilities across complex tasks or gather information and rank threats without taking direct action. Organizations set the scope of automation to match their operational goals.

AIP restricts the query commands each agent can run; commands outside an approved list cannot be executed. Staff approval can be required for commands that affect operations, such as blocking an IP address or isolating a system. Analysis and low-risk actions can run automatically within permitted limits, while major actions require human approval; organizations can also verify results and whether actions were appropriate.

According to Logpresso, AIP is first producing adoption results in financial sectors such as insurance and securities. These firms have introduced agentic SOC in on-premises environments that do not depend on external cloud services, automating investigation, analysis, response, and reporting with AI agents even under strict regulatory requirements.

Logpresso has proposed AIP, an AI agent platform for automating security operations. As AI-enabled cyberattacks become more sophisticated and faster, security teams must sift through ongoing alerts to identify real threats and decide how to respond. Organizations with too few specialists may struggle to maintain the same level of monitoring overnight and on holidays, while manual investigation and response after detection take longer.

AIP connects data collection, analysis, detection, response, and reporting through Logpresso’s SIEM, SOAR, and XDR platforms. It supports SOC (security operations center) workflows that query logs, compare information from multiple security products, assess whether an attack is underway, and record actions and their rationale. An agentic SOC analyzes logs from different systems and uses MITRE ATT&CK tactics and techniques to understand the context of threats.

Taking into account that time can pass between detecting a threat and a staff member reviewing it and responding—as with ARTEX, which was used in attacks on financial firms—AIP agents begin an automated investigation when they detect a threat. They analyze relevant data and key issues, record evidence and findings, and prepare initial response actions. Staff can review the analysis and its rationale in a messaging app and approve a response, allowing them to act overnight or on holidays without being at a console.

Logpresso also provides a builder for designing agents to fit an organization’s environment and policies. Users can set each agent’s role, instructions, query commands, skills, and workflow, and assign sub-agents to work with it. Agents can divide responsibilities across complex tasks or gather information and rank threats without taking direct action. Organizations set the scope of automation to match their operational goals.

AIP restricts the query commands each agent can run; commands outside an approved list cannot be executed. Staff approval can be required for commands that affect operations, such as blocking an IP address or isolating a system. Analysis and low-risk actions can run automatically within permitted limits, while major actions require human approval; organizations can also verify results and whether actions were appropriate.

According to Logpresso, AIP is first producing adoption results in financial sectors such as insurance and securities. These firms have introduced agentic SOC in on-premises environments that do not depend on external cloud services, automating investigation, analysis, response, and reporting with AI agents even under strict regulatory requirements.