Listen to this Post
Introduction:
The cybersecurity industry is racing to deploy AI agents across Security Operations Centers (SOCs), but most of these initiatives are failing before they even begin. The problem isn’t the intelligence of the models—it’s the context they have access to. As security teams experiment with agentic workflows, a fundamental truth is emerging: an AI agent’s verdict is only as reliable as the context it reasons over. Without a robust data-access layer that provides breadth, depth, speed, and precision, even the most sophisticated agents remain stuck in pilot purgatory, unable to deliver on the promise of autonomous security operations.
Learning Objectives:
- Understand why context—not model capability—is the primary bottleneck for AI agents in security operations
- Learn how to implement a security data lake architecture that enables agentic workflows at scale
- Master the Model Context Protocol (MCP) and API-first approaches for connecting AI agents to security data
- Acquire practical commands and queries for threat hunting, detection engineering, and automated investigations
- Evaluate the future impact of context-aware AI agents on SOC efficiency and analyst workload
- The Context Layer: Why Data Access Defines Agent Success
The most important part of a security agent might not be the agent itself—it’s the context the agent has. Successful production agents are connected to enough real security data to do useful work, while those that get stuck in pilots are narrow experiments with limited context. The major unlock is a combination of breadth, depth, speed, and precision for accessing security data.
This is precisely why platforms like Scanner are gaining traction. Scanner isn’t just a faster interface for security data; it’s closer to a substrate for accessing security context in ways that make agentic workflows vastly more useful. By connecting AI agents to security data lakes through a Model Context Protocol (MCP) server, Scanner enables interactive investigations, detection engineering, and autonomous response workflows.
The hard part isn’t the lack of data—organizations already have assets, identities, vulnerabilities, logs, and observability data. The challenge is making that data accessible and flexible enough for agents to act upon during investigations, detection engineering, and response. Useful agents don’t need a giant context dump upfront; security investigations unfold step by step: ask a question, find a clue, pull the next thread, refine the hypothesis. The agent needs to fetch the right context as the work evolves.
Step-by-Step: Setting Up an MCP-Enabled Security Data Layer
- Deploy a security data lake that indexes logs directly in cloud storage (e.g., AWS S3) with inverted indexes built at ingestion time.
- Configure the MCP server to provide structured access to your security data through a standardized interface. For Scanner, this involves setting the MCP endpoint and API key:
Set environment variables export SCANNER_MCP_ENDPOINT="https://mcp.your-env-here.scanner.dev/v1/mcp" export SCANNER_MCP_API_KEY="your-scanner-api-key"
- Connect your AI agent to the MCP server. For Claude Desktop, add the server configuration to your client settings. For programmatic access, use the Agent SDK:
from scanner_sdk import ScannerClient client = ScannerClient(api_key=os.environ["SCANNER_MCP_API_KEY"]) Agent can now query across petabytes of security data
4. Validate connectivity by running a test query:
curl -X GET "$SCANNER_MCP_ENDPOINT/health" \ -H "Authorization: Bearer $SCANNER_MCP_API_KEY"
5. Define access controls to ensure agents only retrieve data within their authorized scope, using identity-first security principles.
2. Querying Security Data Lakes at AI Speed
Traditional SIEMs cannot support AI workloads effectively. AI agents need to run dozens of exploratory queries to understand data and find threats. When each query takes 30 minutes, AI investigations timeout or become impractical. Modern security data lakes deliver sub-second queries, letting AI agents iterate freely—running 20+ queries in the time traditional systems complete one.
The economics matter too. Traditional systems charge $50–$100 per query, making AI exploration prohibitively expensive. Modern data lake architectures reduce query costs to $0.01–$0.10, making it economically viable for AI to explore freely without budget constraints.
Practical Query Examples
KQL (Kusto Query Language) for Microsoft Sentinel:
// Find all failed login attempts from a specific IP SigninLogs | where IPAddress == "203.0.113.45" | where ResultType != 0 | project TimeGenerated, UserPrincipalName, ResultType, AppDisplayName | order by TimeGenerated desc
SQL for Security Data Lake (Red Canary):
-- Unauthorized attempts against AWS services in the last 7 days SELECT time, service, event_name, user_identity, source_ip FROM cloudtrail_logs WHERE event_name LIKE '%Unauthorized%' AND time > CURRENT_DATE - INTERVAL '7' DAY ORDER BY time DESC;
Scanner Natural Language Query (via MCP):
"Show me all S3 access from this IP in the last 30 days, then check what else they did."
The AI translates this to queries, explores data, and generates comprehensive reports—no query language required.
Windows Command-Line Threat Hunting:
Query Windows Event Logs for suspicious PowerShell execution wevtutil qe Security /c:50 /f:text /q:"[System[(EventID=4688)] and EventData[Data[@Name='ProcessName']='C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe']]" Check for hidden window execution (MITRE T1564) wmic process where "name='cmd.exe'" get commandline | findstr /i "/B"
Linux Threat Hunting Commands:
Find suspicious processes with network connections ss -tulpn | grep ESTABLISHED Check for unusual cron jobs cat /etc/crontab /var/spool/cron/ 2>/dev/null Detect reverse shells using common ports netstat -an | grep -E ":(443|4444|1337)" | grep ESTABLISHED
3. Detection Engineering with AI Agents
Detection engineering is being transformed by AI agents that can read a detection’s intent, write new logic based on a threat model, and pivot across your entire data lake in a single motion. Instead of manually converting Splunk queries to other formats, AI agents can paste Splunk/Sumo/Datadog queries and automatically convert them to the target query language, test them on your data, and suggest tuning.
Step-by-Step: AI-Powered Detection Rule Migration
- Extract existing detection rules from your current SIEM:
Example Splunk query for credential dumping detection index=windows EventCode=4688 ProcessName="\mimikatz.exe" OR CommandLine="sekurlsa::logonpasswords"
- Feed the query to an AI agent connected to your security data lake via MCP.
- The agent translates the query to the target platform’s language (e.g., Scanner query language, KQL, or SQL).
- The agent tests the translated query against historical data to validate coverage.
- The agent suggests tuning parameters based on false positive rates and detection gaps.
MITRE ATT&CK Mapping Example:
Python script to map detection rules to MITRE ATT&CK techniques
import requests
def map_to_mitre(technique_name):
url = f"https://api.mitre-attack.com/v3/techniques?name={technique_name}"
response = requests.get(url)
return response.json()
Example: Map "PowerShell execution with hidden window" to T1059.001
technique = map_to_mitre("PowerShell")
print(f"MITRE ID: {technique['id']} - {technique['name']}")
Detection Gap Analysis: AI agents can review your detection rules, map them to MITRE ATT&CK, identify coverage gaps, and suggest new detections based on your environment and threat landscape.
4. Autonomous Threat Hunting and IOC Enrichment
One of the most powerful applications of context-aware agents is autonomous threat hunting. An agent can continuously run in the background, fetching fresh vulnerability data from authoritative sources (NVD, CISA KEV, EPSS) and evaluating each CVE against your configured risk thresholds, keywords, and metrics.
Step-by-Step: Automated IOC-Based Threat Hunting
- Ingest threat intelligence from feeds like CISA’s Known Exploited Vulnerabilities:
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | jq '.vulnerabilities[] | {cveID, vendorProject, product, vulnerabilityName, dateAdded}' - Extract IOCs from breach reports or threat advisories using the agent’s natural language processing capabilities.
- Search your security data lake for matches across years of logs:
-- Search for CVE-2025-XXXX exploitation attempts SELECT time, source_ip, dest_ip, user_agent, cve_id FROM vulnerability_scans WHERE cve_id = 'CVE-2025-XXXX' UNION ALL SELECT time, source_ip, dest_ip, '', '' FROM network_logs WHERE uri CONTAINS '/exploit/CVE-2025-XXXX'
- Correlate findings across multiple data sources (assets, identities, vulnerabilities, logs, observability).
- Generate impact assessments and escalate high-confidence threats, suppressing known false positives.
Linux Command for IOC Search Across Logs:
Search for specific IP across all log files
grep -r "203.0.113.45" /var/log/ --color=auto
Check for suspicious file hashes
find / -type f -exec sha256sum {} \; 2>/dev/null | grep -f ioc_hashes.txt
Windows PowerShell for IOC Search:
Search Event Logs for specific process creation
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} |
Where-Object {$<em>.Properties[bash].Value -match "malware.exe"} |
Select-Object TimeCreated, @{N='User';E={$</em>.Properties[bash].Value}},
@{N='Process';E={$_.Properties[bash].Value}}
5. API-First Architecture for Custom Security Workflows
The shift toward agentic security operations demands an API-first approach. Every query, every dataset, and every detection rule should be accessible programmatically. This enables custom workflows, integration with existing SOAR platforms, and seamless automation.
Step-by-Step: Building a Custom Security Automation Workflow
- Set up API authentication for your security data lake:
export SCANNER_API_KEY="your-api-key" export SCANNER_API_ENDPOINT="https://api.scanner.dev/v1"
2. Query the API programmatically using Python:
import requests
import json
headers = {"Authorization": f"Bearer {os.environ['SCANNER_API_KEY']}"}
query = {"dataset": "aws_cloudtrail", "time_range": "7d", "filter": "event_name LIKE '%Unauthorized%'"}
response = requests.post(f"{os.environ['SCANNER_API_ENDPOINT']}/query",
headers=headers, json=query)
results = response.json()
3. Create detection rules using the API:
curl -X POST "$SCANNER_API_ENDPOINT/detections" \
-H "Authorization: Bearer $SCANNER_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name": "Suspicious S3 Access", "query": "SELECT FROM s3_logs WHERE operation='DeleteObject' AND user_identity NOT IN (SELECT user FROM approved_users)"}'
4. Automate response actions by triggering playbooks when detections fire:
Webhook receiver for detection alerts
from flask import Flask, request
app = Flask(<strong>name</strong>)
@app.route('/webhook/detection', methods=['POST'])
def handle_detection():
alert = request.json
Automatically isolate compromised instance
if alert['severity'] == 'critical':
isolate_instance(alert['instance_id'])
return "OK", 200
Cloud Hardening Commands (AWS CLI):
Audit S3 bucket policies for public access aws s3api get-bucket-acl --bucket your-bucket Check IAM roles for overly permissive policies aws iam list-policies --scope Local --only-attached | jq '.Policies[] | select(.DefaultVersionId != null)' Enable CloudTrail for all regions aws cloudtrail create-trail --1ame security-trail --s3-bucket-1ame your-bucket --is-multi-region-trail aws cloudtrail start-logging --1ame security-trail
- The Context Graph: Building a Live Model of Your Environment
An AI SOC agent is only as good as the picture it reasons from, and in most SOCs that picture is rebuilt from scratch on every alert. The future lies in context graphs—live models of your environment that every agent reasons on, rather than static stores that each agent re-derives.
What a Context Graph Enables:
- Relationship awareness: Agents can distinguish between public and confidential information before surfacing it
- Sensitivity awareness: Instead of blindly retrieving text, agents reason about context and apply the right guardrails
- Situational awareness: Modeling relationships, rules, and risk as an active system, not static rules
Implementation Approach:
- Ingest data from all security tools (SIEM, EDR, vulnerability scanners, identity providers).
- Build a graph database (e.g., Neo4j) that models entities (users, assets, IPs) and relationships (access, ownership, vulnerabilities).
- Connect AI agents to the graph via MCP, enabling them to traverse relationships during investigations.
- Implement GraphRAG (Graph Retrieval-Augmented Generation) so agents navigate structured relationships to solve complex queries.
What Undercode Say:
- Context Is the Differentiator: The quality of AI output is closely tied to the quality of security data. Good integrations and data governance are becoming just as important as the model itself. AI compliance agents that only see policies can’t do useful work; the ones that work are connected to access logs, control evidence, vendor records, and incident history all at once.
-
Step-by-Step Investigations Win: Security investigations unfold iteratively—ask a question, find a clue, pull the next thread, refine the hypothesis. Agents need to fetch the right context as the work evolves, not just consume a giant context dump upfront. This dynamic access pattern is what separates useful agents from toys.
-
Economics Drive Adoption: Traditional SIEMs charge $50–$100 per query, making AI exploration economically impossible. Modern data lakes with sub-second queries at $0.01–$0.10 per query unlock entirely new workflows. The question shifts from “Can I look up this one thing faster?” to “What investigations would I attempt if an agent could work across all of this context for me?”
-
MCP Is the Standard: The Model Context Protocol is emerging as the standardized interface for connecting AI agents to security data. Platforms that natively support MCP—like Scanner, GreyNoise, and Microsoft Sentinel—are positioned to lead the agentic SOC transformation.
-
API-First Is Non-1egotiable: Agentic workflows demand programmatic access to every query, dataset, and detection rule. Organizations still relying on GUI-only security tools will find themselves unable to scale autonomous operations.
Prediction:
-
+1 The convergence of security data lakes, MCP, and agentic AI will reduce mean time to detection (MTTD) by 60–80% within 18 months, as agents continuously hunt for threats while analysts sleep.
-
+1 Context graphs will become the new SIEM, replacing traditional log-centric architectures with relationship-aware models that enable agents to reason about complex attack chains in seconds rather than hours.
-
-1 Organizations that fail to implement a unified data-access layer for their agents will see AI initiatives stall in pilot phase, wasting millions on model licenses without realizing operational value.
-
-1 The skills gap will widen as security teams struggle to transition from traditional SIEM query languages (Splunk SPL, KQL) to agentic workflows that require API-first thinking and MCP configuration expertise.
-
+1 The economics of security data lakes will democratize advanced threat hunting, enabling mid-sized organizations to achieve detection capabilities previously reserved for Fortune 500 enterprises.
-
-1 Without proper governance and access controls, AI agents with broad data access could become a liability, inadvertently exposing sensitive data or executing destructive queries at scale.
-
+1 Natural language investigation interfaces will eliminate the query language barrier, allowing junior analysts to perform complex investigations previously requiring years of SIEM expertise.
-
+1 The integration of vulnerability intelligence (NVD, CISA KEV, EPSS) with agentic workflows will enable proactive risk mitigation, with agents automatically prioritizing and patching vulnerabilities before exploitation occurs.
▶️ Related Video (78% Match):
https://www.youtube.com/watch?v=0dG-0nyBvQQ
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Colegrolmus The – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
