The SOC Assistant helps you analyze security data, suggest next steps, and answer complex security questions. To make the assistant even more powerful, you can manage custom Playbooks and Memory entries that provide tailored context for your specific environment and workflows.

How the Assistant Works

When you interact with the SOC Assistant, it draws upon your active session, any linked pentest data, and the persistent knowledge stored in your Playbooks and Memory.

flowchart LR
    User["Security Analyst"] -->|Sends Message| Chat["Assistant Chat"]
    Chat -->|Loads Context| Memory["Memory Entries"]
    Chat -->|References| Playbooks["Active Playbooks"]
    Chat -->|Analyzes| Pentest["Linked Pentest Data"]
    Memory -.-> Chat
    Playbooks -.-> Chat
    Pentest -.-> Chat

Managing Assistant Sessions

Chat sessions isolate different investigations or conversations. You can create standalone sessions or link them directly to a specific pentest ID.

Starting a Conversation

1. 1

   Create a session

   First, initialize a new session. If you are investigating a specific pentest, include its ID in the request body.

   {
     "pentest_id": "pt_12345abc"
   }

2. 2

   Send a message

   Use the session_id returned from the previous step to send your prompt to the assistant.

   {
     "session_id": "sess_9876xyz",
     "message": "Summarize the critical findings from this pentest and suggest remediation steps.",
     "pentest_id": "pt_12345abc"
   }

3. 3

   Review the response

   The assistant will analyze the linked pentest and return a detailed, actionable response based on your prompt.

Working with Playbooks

Playbooks act as standard operating procedures (SOPs) or guided workflows. By defining playbooks, you ensure the SOC Assistant handles specific types of incidents (like phishing or malware outbreaks) consistently.

Example: Creating a Playbook

curl -X POST https://api.yourstudio.com/playbooks/phishing-response 
  -H "Content-Type: application/json" 
  -d '{
    "description": "Standard response steps for reported phishing emails.",
    "content": "1. Isolate the affected host. 2. Block the sender domain. 3. Reset user credentials."
  }'

Managing Memory

Memory entries allow you to store persistent facts about your organization—such as network architecture, VIP user lists, or specific compliance requirements. The assistant uses these memory entries to provide highly contextualized answers.

Frequently Asked Questions