What it does
It takes the alert, decides what it needs to know, queries EDR, identity, network, and inventory, builds the timeline, and returns a case with a hypothesis and its evidence. The analyst steps in to judge and respond.
The difference from a SOAR playbook is who chooses the path. A playbook runs a sequence somebody wrote in advance: if X happens, do Y. The agent decides case by case which question to ask next, which is why it handles the alert nobody anticipated.
In practice the two coexist. The agent interprets and picks which SOAR automation to trigger.
Where it gets it right
Repetitive volume with a stable pattern. A known EDR false positive, a login from a new country with justified travel, a DLP alert on an attachment that has been cleared ten times. Here the agent returns analyst-hours every week and does not get tired at night.
Where it gets it wrong
It fails when business context is missing, which is the most expensive gap. It knows the host had anomalous traffic; it does not know that server issues invoices and that taking it down at 2pm costs more than the incident.
And it fails confidently. The output reads well even when the connection is invented, which is worse than reading confused, because it raises no suspicion.
Questions before handing it a credential
Which identity does it act under, and is the scope the task's or inherited from a human. Whether the log keeps the reasoning alongside the result. Which actions require approval. How do you reverse them. And who owns the decision when it is wrong.
Worth remembering that the agent reads content third parties write, such as tickets and email. That makes it a target for indirect prompt injection, carrying the permissions you gave it.