Abstract, a security vendor, has announced new AI capabilities for its agentic SIEM, including investigation, hunt, and triage, as well as SOAR-style automated response actions that are assigned directly to detection rules. The features are built into the same platform that already handles collection, routing, and detection, rather than bolted on as a separate layer.
According to the announcement, the platform normalizes and enriches events in stream with identity, threat intelligence, and asset context, creating what the company calls an enterprise context layer. That lets AI models distinguish between different meanings of fields like "src" and start investigations from context the platform already trusts. Abstract's own models, trained by its ASTRO threat research team, are combined with frontier foundation models for deep reasoning.
The vendor says the agentic SIEM works every alert in the queue, so alerts that previously aged out or were bulk-closed now get individual investigations with evidence attached. Customer testimonials in the announcement claim 100% automation of Level 1 triage at one financial services firm and 60%+ automation of SOC workflows overall. The company is also offering to beat existing SIEM bills for the next 100 customers, with a 30-day production trial before signing.
The report is based on a vendor announcement; no independent testing or third-party validation was cited.