Inside an Agentic Investigation: An AI Engineer on Decision Models, Guardrails, and Trust

"An agentic workflow is a team of AI agents that work together to solve a complex task." Each agent has an LLM behind it with an instruction to solve a specific task.

The value Denis points to first: time saved. A SOC team's analysts look through hundreds, sometimes thousands of alerts a day. Each investigation involves pulling logs from Elasticsearch and Splunk, sending emails, filing reports — about 40 minutes of work for an experienced analyst. The agentic workflow converts those steps into AI agents that work autonomously and complete the same investigation in 2 to 3 minutes.

"Typically they are deployed right after the decision layer, and that is the investigation layer."

The Investigation Layer is where an analyst spends most of the time — going through hundreds or thousands of alerts, pulling logs from different SIEMs like Elasticsearch, Splunk, FortiSIEM, sending emails, filing reports, checking threat intelligence sources. After Arcanna's decision models triage the alerts, those alerts go into the Investigation Layer where the agentic workflows do their job automatically.

Denis walks through a real workflow end-to-end. The input is an alert the analyst has to deal with. Once the workflow triggers, the IOC Extractor Agent starts working — extracts IPs, file hashes — and passes that information to the next agent. It's a chain.

Next, the Threat Intel Agent uses sources like VirusTotal and AbuseIPDB to check if an IP is malicious. The Log Analysis Agent does correlations on the alert, looking into Splunk to see if there are other related alerts. The User & Endpoint Agent finds information about the user — role, permissions, machine context. The Reporting Agent wraps it all up with a structured file report of the whole findings.

"The hardest part is to come up with the structure of the agents. You need to identify what task each agent has to solve, and that comes with experience and through many iterations of trial and error."

Denis describes the build loop honestly. You want to solve a complex task. You break it into multiple simpler tasks. You create an agent for each, give it the right tools, and iterate over and over to see the output of the workflow. If you're not satisfied, you go back. You add another agent. You break one agent into two because the simpler task was actually too complex for one agent to solve alone. You run it again. And the results have to satisfy you multiple times — because the AI agent will not output the same result two times in a row.

"First of all, you are in control because you are the one creating them. You are creating the beast."

Once you create the beast, Denis says, you may notice it doesn't do what you want. It goes sideways. You stop it, go back, edit the beast, and run it again until you're satisfied. Beyond that, Arcanna provides what Denis calls a human-in-the-loop agent — an agent the user inserts at points in the workflow where execution should pause and ask for guidance. An agent queries a SIEM, identifies a threat. The human-in-the-loop agent stops the workflow and asks: what do I do from here? Continue. Branch. Stop.

The architectural insight worth the most attention. After the Investigation Layer where agentic workflows run, Denis explains that you can't be sure you can trust the output of the agents. So beyond human-in-the-loop checkpoints, Arcanna adds another Decision Layer behind the workflow.

"This decision layer would look at the output of the agents. This decision layer decides if the output of the agent is trustworthy or not." The model doing this validation is trained over time on agent outputs and the team's feedback on them. Eventually you have decision models that can tell you whether agent output is trustworthy — and decision models, Denis points out, can be applied to the Investigation Layer and the agentic workflows themselves, not just to alerts entering the system.