Abstract Expands Its Agentic SIEM: Security-Focused Models, Real-Time Triage, Response on Every Detection

The agentic SIEM now includes investigation, hunt, triage, and response capabilities, powered by Abstract's own security-trained models working alongside frontier foundation models, on the same platform that already detects in stream. 

SAN FRANCISCO, Oct. 20, 2026 /PRNewswire/ -- Abstract today announced new AI SOC capabilities in its agentic SIEM: investigation, hunt, and triage powered by a combination of Abstract's own trained and tuned models and frontier foundation models, and SOAR response capabilities with actions assigned directly to detection rules. The capabilities are built into the platform that already collects, routes, and detects on security data in stream. 

Security teams are facing agentic attacks that move at machine speed while their own tooling spreads the response across a pipeline vendor, a SIEM, a SOAR, a threat intelligence feed, and an AI triage bolt-on. Dozens of AI SOC vendors sell agents that sit on top of someone else's alerts and add another contract to the stack. Abstract runs the entire loop on one platform: 400+ integrations feed streaming detection that operates in real time, before data lands, findings combine into entity-based insights, and the SIEM itself now investigates, classifies, and responds on the same data plane. 

Most AI bolted onto the SOC re-enriches the same alert from scratch every time it looks at one. Abstract's pipeline builds an enterprise context layer that makes the data AI ready before the alert ever fires: events are normalized and enriched in stream with identity, threat intelligence, and asset context. That normalization gives AI the security semantic layer it needs, so a field like "src" is never confused between the sender of the data, the host that opened the connection, or the internal host another source means by it, and every investigation starts from context the platform already trusts. 

The agentic SIEM works every alert in the queue. Alerts that once aged out or got closed in bulk to keep the queue moving now each get an investigation with evidence attached, and analysts review conclusions instead of raw alerts. 

"Attackers are using AI, and the window between first signal and real damage keeps shrinking. Customers ask a simple question: what got worked, what got stopped, and can I see the evidence," said Colby DeRodeff, CEO and co-founder of Abstract. "Our models exist to make investigations faster and more accurate. AI bolted onto the SOC enriches every alert from scratch at investigation time; ours start from identity, threat intel, and asset context already in the platform. Our security researchers' expertise lives in the models, the models are in the platform, and the platform works every alert in the queue. That is what we are shipping." 

The new capabilities span the full security operations loop: 

• Investigation and triage run on a combination of Abstract's own proprietary trained and tuned models and frontier foundation models. The ASTRO threat research team trains Abstract's models, baking the team's real-world intelligence into the artificial intelligence of the platform and keeping investigations current with the latest threats the team tracks in the field. 
  
  
• Real-time classification. Abstract's models return triage decisions in real time, keeping analysis moving at the pace of the stream and feeding response actions while activity is still underway. 
  
  
• Threat hunting runs on the same data plane as detection and investigation, across the identity, cloud, endpoint, SaaS, and network data already flowing through the platform. 
  
  
• SOAR capabilities. Automated response is built into the platform, with containment, enrichment, and notification actions firing the moment a detection matches. 
  
  
• Investigations Astro runs today include threat intelligence detections, endpoint agent analysis, insider risk analysis, phishing and suspicious mail triage, and cloud attack analysis. 

"Our analysts were spending their days confirming that normal things were normal," said the security operations director at a leading healthcare insurance company. "Abstract's investigations now make that pass across the whole queue with the evidence laid out, and the team spends its time on the handful of cases that deserve a human." 

Where foundation models trained on the open internet bring broad knowledge and unvalidated confidence, Abstract's models ground each assessment in the ASTRO team's validated threat expertise, so verdicts reflect how attacks actually unfold rather than how they read in public write-ups. Foundation models handle the deep reasoning on cases that warrant it, with the full evidence trail preserved. 

"When we upgraded to Abstract's agentic SIEM, we were able to automate 60%+ of our SOC workflows, including 100% of the Level 1 triage," said the CISO of a global financial services organization. 

"Most SIEM contracts are a bad relationship SOC teams want to leave, but, as the saying goes, 'it's complicated'. The data gets metered, the bill goes up, and alerts still wait hours for an analyst when a machine could have worked them," said Jon Eller, Chief Revenue Officer at Abstract. "Abstract covers the job end to end: pipeline, detections, lake, SIEM, and now the investigation. For our next 100 customers we're making the breakup easy. Send us your current SIEM bill, we'll come in under it, lock the price for three years, and give you 30 days in production before you sign." 

Availability 

The new AI SOC capabilities are generally available today as part of the agentic SIEM. Investigation bundles are available as add-ons sized by alert volume. Existing customers can add investigation bundles through their Abstract account team. Details at https://abstract.security/breakup.   

About Abstract 

Abstract helps security teams see and stop threats faster. Its platform combines a security data pipeline and agentic SIEM, with Astro, the AI embedded throughout, working every layer from data to detection to verdict. Teams cut log volume, detect threats in stream before data hits storage, and go from alert to verdict in minutes, not hours. Abstract is available on the AWS, Microsoft Azure, and Google Cloud marketplaces. Abstract was founded in 2023 by veterans of ArcSight, Bank of America, Mandiant, and Palo Alto Networks. Learn more at https://www.abstract.security/ 

Contact 

Jill Pescosolido 

VP Marketing, Abstract 

[email protected] 

SOURCE Abstract Security Inc