Intezer Expands Automation Capabilities for SOC Teams with Custom Agents

A new feature from Intezer is set to streamline the work of security teams by allowing them to automate custom security tasks. The company has announced Custom Agents, a capability that enables customers to build their own AI agents directly within the Intezer platform. This move builds on Intezer’s existing approach, which uses autonomous agents to handle security tasks and have humans oversee the process.

Security teams are no longer able to rely solely on manual alert handling or one-off automation due to the high volume and complexity of modern threats. Intezer’s core platform already employs autonomous agents to triage, investigate, and respond to alerts around the clock. These agents investigate 100 percent of alerts and escalate fewer than 2 percent for human review.

The introduction of Custom Agents allows customers to build on this foundation by automating additional investigation work, report generation, and other recurring SOC routines that are unique to their environment. This means security teams can now automate tasks such as writing custom incident reports, sharing shift handoff notes, tuning detection rules, and documenting investigation outcomes.

Intezer found through analysis of how teams used its AI chat for these workflows that more than a third of conversations involved the same repetitive tasks being requested again and again. Custom Agents turn those tasks into agents that run on their own, freeing up security personnel to focus on higher-level tasks.

The existing Intezer customers are already using agents in production for various tasks such as writing custom incident reports, providing recommendations on tuning rules based on triage verdicts, and proactive threat hunting. With Custom Agents, security teams can automate their unique individual and team processes by building their own AI agents that run on the same engine operating their SOC.

According to Itai Tevet, CEO of Intezer, ‘With Custom Agents, we are giving customers the power to automate their own unique workflows, running them precisely how they choose.’ This means security teams can describe what they want done, choose when it runs (on a schedule, on an event such as a closed case, or on demand), and pick the tools it can use.

Custom Agents work across the stack, combining Intezer’s built-in toolset with connected SIEM, EDR, and identity tools including CrowdStrike, SentinelOne, Splunk, Microsoft Sentinel, and Entra ID. They take action by updating, commenting on, and closing cases and emailing finished reports.