SOC AI Agent

The orchestrator classifies each event by log type and context, delegates to one of eight specialists, and consolidates analysis before creating or updating an incident.

JSON/REST API, Wazuh SIEM/XDR, Splunk HEC, CEF (ArcSight), Syslog (RFC 5424/3164), webhooks, WordPress SOC Collector plugin, Cloudflare, Go agents for Windows/Linux, and custom connectors.

Playbooks define triggers (category, score, severity), conditions, and actions. Run fully automatic or require manual approval before remediation.

A proprietary network sharing only real threats — IOCs with SOC hits and confirmed incidents. Public feed data is not shared.

Immutable audit trails, retention policies, exports for data subjects, and breach notification reporting (e.g. GDPR Art. 33).

Indicators are correlated with logs and incidents. IOC Feed and TI History show matches; Threat Network reinforces community-validated IOCs.

Yes. Go agents for Windows and Linux, plus the WordPress SOC Collector plugin with IP blocking.

Perimeter and CDN events correlate web attacks with internal incidents and can trigger blocking playbooks.

Automatic playbooks can respond in under one second. Specialist-per-log-type analysis drastically reduces false positives in tuned environments.

Yes. Send events via Syslog, CEF, Splunk HEC, JSON API, or Wazuh. SOC AI Agent correlates, analyzes with AI, and responds via SOAR without replacing your SIEM.

Yes. Configure thresholds, playbooks, whitelist, connectors, retention, and auto/manual modes per environment.

MDR (Managed Detection and Response) is the managed detection and response service we deliver with SOC AI Agent. We monitor your environment 24/7, detect threats, and respond autonomously — no internal SOC team required.

Human-in-the-loop is the mechanism by which the autonomous agent, upon identifying a critical context or sensitive action, automatically escalates to a human analyst to validate the decision before execution. It ensures day-to-day autonomy and reinforced safety when risk demands it.

The agent escalates when severity, critical environment, potential action impact, or analysis confidence indicate that human validation improves safety — for example, critical incidents, sensitive assets, or invasive remediation. Human analyst availability depends on your chosen plan.

The agent operates autonomously on all plans. Some plans include human analysts who participate in the human-in-the-loop flow when the agent escalates. Availability depends on your plan — contact us to find the right fit for your environment.

Agent XDR is Dolutech's native endpoint detection layer: lightweight agents on Windows and Linux stream real-time telemetry (processes, files, registry, network), a Sigma rules engine continuously updated and managed in the web panel, and detections that trigger real-time SOAR response — isolation, blocking, and incident correlation. It is built into SOC AI Agent — not a separate third-party XDR product.

Analysts submit suspicious files or malicious evidence from the SOC AI Agent web console. The sandbox runs samples in an isolated environment — never on production endpoints — returns a malicious/suspicious/clean verdict with behavioral detail, and links results to incidents, IOCs, and AI enrichment.

SOC AI Agent continuously monitors SPF, DKIM, and DMARC DNS records for your domains, alerts on misconfigurations or spoofing risk in the web panel, and correlates authentication failures with phishing and incident workflows.