Threat intelligence agents

Threat intelligence agents turn incoming threat intelligence into Space-specific detection work.

Perpetual launches one agent to summarize each substantive threat intelligence item as a single security-focused paragraph in its threat report. For every non-System Space, Perpetual launches another agent to evaluate the report. The agent compares the report's behaviors with the Space's datasets, existing detections, and open content work items. For each behavior that the Space can detect but does not already cover, the agent opens a content work item and launches the content engineering agent to stage the proposed detection in a changeset for you to review.

Related

• Threat report, the feed item and enriched content the agents summarize and evaluate.
• Detection opportunity, a content work item that threat report triage opens.
• Background agents, the agents Perpetual launches from product workflows.