Agentic threat hunting only works when the SOC has strong telemetry, clear baselines, and guardrails, because AI amplifies existing gaps instead of fixing them. Sydney Marrone’s framework shows that tools like ATHF, ADEF, LOCK, and FORGE help teams build the foundation needed for effective hunting and detection engineering. #SydneyMarrone #Nebulock #Splunk #THORCollective #ATHF #ADEF #LOCK #FORGE
Keypoints
- AI agents in the SOC can amplify weaknesses if the foundation is poor.
- Normalized telemetry and identity stitching are essential for agentic hunting.
- Guardrails are needed to limit what agents can do when they are wrong.
- Baselines let agents spot behavior that does not belong in the environment.
- ATHF and ADEF structure hunting and detection engineering into repeatable workflows.
Read More: https://www.cybersecuritypulse.net/p/the-soc-readiness-pyramid-for-agentic