A SCENARIO TO EVALUATE YOUR AGENTIC SOC

Summary from the TLDR InfoSec newsletter

A SOC investigation loop requires assembling a full attack chain from various different signals that may look benign or unrelated, which traditional, deterministic playbooks may miss. The authors built a set of scenarios to evaluate agentic SOC's investigative ability and built their own harness (called Tengu). Their scenario involves a GitHub workflow vulnerability that leads to full Kubernetes cluster compromise, which then is escalated to full AWS account compromise. Of the models tested on a naive prompt, only Opus 5 managed to identify the alert as a true positive without the Tengu harness