Agentic SOC, Demystified: From Buzzword to Working Pipeline

No ratings

Presented at BSides Toronto 2026 by

AbdulMoiz Lakdawala

"Agentic SOC" is the security buzzword of the moment, and most of what you've heard about it is vendor marketing. This talk strips away the hype and shows you what an AI agent actually is :a brain (an LLM that reasons), tools (the actions it's allowed to take), and memory (the context it can retrieve) then maps those three pieces directly onto components you already run. Using Splunk and a small live demo, you'll watch a trigger wake an agent, design and run its own queries, and return a triaged result. You'll leave knowing how to build a basic agentic detection-and-triage pipeline yourself, and just as importantly where it breaks and why it isn't the turnkey magic you've been sold.