Q: What is the Dojo AI for SOC investigations guide and how does it help SOC teams? A: Dojo AI is Sumo Logic’s agentic artificial intelligence platform for security operations that combines agentic AI, log intelligence and secure model integration. The Dojo AI for SOC investigations guide explains how the SOC Analyst Agent, Knowledge Agent and MCP server work together to speed triage, provide citable knowledge and connect customer-owned copilots to cut alert time. Q: How does the SOC Analyst Agent speed triage and investigations? A: The SOC Analyst Agent applies agentic AI reasoning to each alert, suggests severity and likely impact, pulls related activity to build a clear timeline and presents context so analysts can decide faster. It is launching in beta and delivers verdicts and enrichment to reduce alert fatigue and accelerate investigation steps. Q: What does the Knowledge Agent do and how do analysts access it? A: The Knowledge Agent answers “how-do-I” questions in natural language through Mobot, returning straightforward, citable steps drawn from documentation and product knowledge. It is available now within the Sumo Logic platform and helps reduce friction and accelerate onboarding for new analysts. Q: What is the MCP server and how does it enable integration with external AI? A: The MCP server implements the Model Context Protocol to connect customer-owned copilots, models and third-party AI into Dojo while maintaining scale, consistency and security. It lets organizations bring their own AI without creating tool sprawl and is currently available as a beta/prototype to select customers. Q: How should SOC teams structure the triage and investigation workflow using this guide? A: The guide lays out a four-step core workflow: intake and triage (alerts arrive, the SOC Analyst Agent proposes severity and enriches events), scope and investigate (trace lateral movement, query logs and call connected copilots), decide and act (pick a playbook and automate safe actions like isolate, reset or block), and learn and improve (ask the Knowledge Agent and update playbooks). Teams should start with the agent’s suggested context, log decision paths for audit and iterate on playbooks. Q: What practical steps does the guide recommend to cut alert time quickly? A: Prep data and rules by mapping top alert types and noisy sources, define severity criteria and accepted auto-actions, and normalize metadata for clean joins; wire up the AI ecosystem by connecting copilots to the MCP server with strict scopes and read-only first; and standardize short, testable playbooks stored where the Knowledge Agent can cite them. Then pilot with a single use case, shadow-run the SOC Analyst Agent for two weeks, measure gains and tune prompts before expanding. Q: Which metrics and KPIs should teams track to prove value? A: Track MTTA (time-to-acknowledge), MTTR (time-to-remediate), false-positive rate, analyst throughput and time-to-competency and tie them to a baseline so improvements are measurable. The guide recommends proving value within a 30–90 day window by measuring those indicators. Q: How does the guide recommend managing risk and governance when using agentic tools? A: Set human-in-the-loop for medium and high-risk actions, log all agent suggestions and executions for audit, segment sensitive data to limit model access and use allowlists for external AI calls via the MCP server. It also advises running chaos tests, defining approval policies and staging actions (read-only first) to surface bad prompts and edge cases before enabling full automation.