Take a tour of Elevate in the Sekoia autonomous SOC platform
See what an autonomous security operations center looks like in practice. Guided investigations and shared workflows help SOC teams respond to advanced threats at machine speed.
Sekoia Elevate is an AI-driven investigation capability within the Sekoia AI SOC platform that triages and investigates alerts and cases. Each AI verdict includes the questions the agent asked, the evidence it found, and the reasoning it followed.
Analysts can filter alerts by verdict to isolate true positives, removing noise from the alert queue and reducing unnecessary review time.
Within an individual alert, the investigation summary provides outcome and confidence level written for human analysts. The Sigma detection rule that triggered the alert is visible and linked directly to the relevant intelligence, including ATT&CK mappings. Sigma rules are created by the Sekoia TDR team or detection engineers, with generative AI support. Intelligence from the Sekoia TDR team is also factored into agent investigations.
Each alert includes Findings — discrete observations made by the AI agent. Analysts can expand each Finding to see the exact query or action the agent executed, allowing immediate verification of the underlying data. The Findings view gives a consolidated summary of everything the agent uncovered.
Reasoning questions show every line of investigation the agent explored. Agents work through each question using available platform data and tools, and each answer feeds into the final verdict.
Agent behavior is shaped by Runbooks, which are automatically generated by Sekoia Elevate for every detection rule, including custom ones. Each Runbook has three editable sections: Detection Rationale, which gives the agent context about why the alert exists and what it detects; false positive scenarios, which describe legitimate conditions that might trigger the rule in a specific environment; and investigation questions, which map directly to the reasoning questions used during triage. Agents may also generate their own investigation questions while processing an alert.
Beyond Runbooks, agents can be configured per organization, which is relevant for MSSPs and MDR providers managing multiple tenants. Available agents are listed in the Elevate settings, with additional agents added as the product evolves. The alert and case investigation agent can be scoped to specific detection rules or set to triage all alerts. Custom instructions and environment-specific context — such as IT infrastructure details or typical user behavior patterns — can be added to improve agent reasoning accuracy.
