webinar
Agentic Workflows in Practice: Architecting Multi-Agent Investigations in a Production SOC
November 6, 2026
How does a triage agent defensibly auto-close 80% of alert volume with evidence attached? What role does an orchestrator play in supervising specialist agents for packet forensics, identity, and threat intel? And how do you implement proper constraints to avoid false negatives and other risks?
In this session from the 2026 SANS DFIR Summit Solutions Track, explore the working machinery behind multi-agent investigation workflows, including triage, orchestration, specialist agents, RAG, and the prompts that keep them reliable.