Can You Trust Your Agent's Security Investigation?

Quick answer:

In an agentic SOC, an alert alone rarely tells an agent enough to determine what happened, meaning that the agent cannot reliably determine whether an event represents a false positive or a real threat that requires action.

Network, endpoint, identity, and related activity give the agent the context it needs to verify what happened and distinguish a real threat from a benign event. With that context, the agent can make a more informed decision about whether to investigate further, escalate, or take action.

Why Agentic Output Can Look Trustworthy Without Being Trustworthy

Security teams are using AI to investigate alerts and they’re repeatedly running into an obstacle: the output reads well, but the result is overstated and incorrect, forcing the team to take on the verification that AI was supposed to handle.

A security analyst might naturally conclude that the model isn’t good enough and that a more capable model will yield more accurate results. However, a model is only part of an agentic investigation.

Every agentic investigation also depends on the harness — the software around the model that determines what it can see, do, and remember within an organization’s policies — running the investigation and the context that an agent receives. A more capable model can improve reasoning, but the quality of the outcome heavily depends on the context available. Missing context can lead to inaccurate outcomes. 

The Missing Context In An Agentic Investigation

Context is the information that an agent uses to understand an alert in the environment. Telemetry is one source of that context; the relationships between identities, devices, systems, activity and other data connect the evidence needed to determine what happened.

For example, a suspicious network connection may trigger an alert, but without surrounding context, the agent only has the alert’s description to work with.

Context gives the agent the evidence to establish what happened, helping to identify: 

• Which systems were involved. E.g., which host initiated the connection, which system received the connection, and whether the host contacted other systems during the same sequence of activity.
• When the activity occurred. E.g., the timing of the connection and the network activity that occurred immediately before and after it.
• What data was exchanged. E.g., how much data the initiating host sent, how much data the receiving system sent back, and whether the direction and volume were consistent with the alert itself.
• What happened afterward. E.g., whether the host contacted additional systems and whether or not a pattern consistent with lateral movement or beaconing emerged.
• What happened on the endpoint. E.g., which process initiated the connection, and which file, application, or other endpoint artifact the process accessed or created.

An alert states that something happened, but network-derived context builds a structured graph of relationships between entities, showing exactly what happened, what happened in the past, and whether that’s deviating from a norm.

What Separates a Trustworthy Agentic Investigation From an Unverified One

Real agentic investigation begins when the agent is equipped with tools to query the environment directly. For example, a network connector, such as an MCP integration, might give the agent access to wire telemetry that it can use to determine whether a suspected C2 connection involved beaconing, lateral movement, or a data transfer, informing the analyst about whether the connection was malicious or benign.

Endpoint telemetry provides another layer of evidence that helps reveal what happened. By querying host activity alongside network telemetry, the agent can connect events across systems. For instance, was a USB device mounted, was an executable launched, and did the host then establish an outbound connection? The result tells the analyst what caused the network activity, not just that it occurred.

A recent lab test illustrates the difference between an agent working from an alert alone and an agent working with additional context. In the test, the agent received a single input — a suspected command-and-control connection tied to a known, malicious IP address. The agent then restated the alert’s details in more polished language and added formatting, but did not verify the activity.

However, when querying network evidence through the ExtraHop MCP connector, the agent identified the specific user involved and surfaced C2 beaconing and lateral movement. Endpoint evidence tied the connection to a USB device mount and a subsequent executable launched from endpoint telemetry.

The agent combined the alert, the network evidence, and the endpoint evidence into a single executive report, tracing the connection from the initial alert to the executable. 

To see how the investigation unfolded, watch the test case here.

An agent’s evidence index and an auto-generated executive report showing how each finding is traceable to a specific artifact.

With tools to query the environment, the agent pieces network and endpoint evidence into a single timeline. The analyst then receives a conclusion that traces back to the underlying record. The difference between a restated alert and a verified investigation is context.

Determine where a finding derives from. If the finding traces to a specific record, it’s evidence. If the finding only restates the alert, it’s an opinion.

Evaluating Agent Output: Honest Analysis vs. Expanded Alert Language

Four signs indicate whether an agent’s output is a true investigation or simply alert language:

1. Is the agent pulling live metrics or just formatting text? A trustworthy agentic output pulls network records, searches detections, and analyzes underlying metrics. An unverified agentic output regurgitates and formats the same alert details that the agent was initially provided with.

2. Does the agent surface specific details, like users and beaconing? Without context, the model is likely to give broad opinions about an alert. However, with network context, the model identifies the specific user associated with the alert, tracks C2 beaconing, and surfaces lateral movement.

3. Does the agent connect network events to specific endpoint actions? Network context shows the traffic path, but full context ties that traffic directly to host-level evidence, like the exact timing around when an executable launched.

4. Does the agent build a start-to-finish timeline? Paraphrased alerts produce a block of summary text. A true investigation pieces all context together into a chronological executive report showing everything that occurred, from start to finish.

An Alert-only Investigation vs. Context-driven Investigation

The difference between an unverified agentic output and a genuine investigation comes down to what evidence the agent can draw on. The table below compares an alert-only investigation against a context-driven investigation, showing how each handles the same alert — from data source through final result.

Building Agentic Investigations Analysts Can Trust

Security teams can test an agent’s reliability by running the same alert through it twice: first with only the alert text, then with network context attached. Comparing the two outputs reveals whether the agent is investigating the alert or simply rephrasing it.

An agent earns analyst trust by naming the host, tracing the connection's sequence, and tying the activity to an endpoint action. Rewording the alert simply produces a longer, more confident-sounding version of the alert.

As agentic SOCs assume more of the investigation workload, security teams that provide agents with full context will be able to act on agent findings with the highest levels of confidence.

Frequently Asked Questions:

Why does my agentic SOC investigation have a high false positive rate?

A high false positive rate indicates that the agent is working from alert text alone, without network or endpoint evidence against which to check the alert. Network or endpoint evidence enable the agent to assess the activity fully before an alert reaches an analyst.

What is network context in an agentic SOC investigation?

Network context is more than an IP address and a port number. ExtraHop captures file names, file hashes, user identities, HTTP response codes, database SQL commands, and JA4 fingerprints — the unique signatures that identify TLS connections even when the traffic itself is encrypted. In some investigations, the agent can pull the packet capture tied to an alert or extract a file directly from the packet stream for analysis.

A high-level of detail lets the agent determine which systems a suspicious connection reached, whether the connection shows a pattern of beaconing or lateral movement, and how the connection is sequenced against other network activity — giving analysts a complete picture of a potential threat, not just a flagged IP address. 

How much context does an agentic SOC investigation need?

An accurate agentic investigation needs enough context to confirm intent and establish scope, which requires both network and endpoint telemetry. Network context surfaces the signal that moves the agent past a restated alert. Endpoint context ties that signal to a specific process or file on the host.

To work well, a network source needs:

• Deep protocol parsing to expose rich application-layer telemetry to the agent.
• Precise querying capabilities so the agent can extract specific parameters without overwhelming its context window.

ExtraHop's EQL capabilities, exposed through the API, lets an agent request exactly the data that the alert demands; from a single field to a full payload. An agent can start as narrow as a single database command and can stop right there if the alert resolves.

If the investigation needs more evidence, the agent can expand from that single transaction all the way to full packet capture, extracting the exact file or payload carried across the wire.

Together, network and endpoint context give the agent a full sequence to trace, producing evidence that’s strong enough for a conclusion that holds up under scrutiny.