# Building an Agentic SOC on a Stream

DevFeed: [Building an Agentic SOC on a Stream](<https://devfeed.tech/articles/building-an-agentic-soc-on-a-stream-11549.md>)

Original publisher: [Read original article](<https://www.confluent.io/blog/building-an-agentic-soc-on-a-stream/>)

Author: Pavel Lineitsev

Published: 2026-09-10T19:19:05Z

Content type: article

Language: en

Sources: [Confluent: Data in motion](<https://devfeed.tech/sources/confluent-data-in-motion.md>)

Topics: [Agentic SOC](<https://devfeed.tech/topics/agentic-soc.md>), [SOC](<https://devfeed.tech/topics/soc.md>), [Security](<https://devfeed.tech/topics/security.md>), [Streaming](<https://devfeed.tech/topics/streaming.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Automation](<https://devfeed.tech/topics/automation.md>), [data loss prevention](<https://devfeed.tech/topics/data-loss-prevention.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [agentic](<https://devfeed.tech/tags/agentic.md>), [agentic-soc](<https://devfeed.tech/tags/agentic-soc.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [automation](<https://devfeed.tech/tags/automation.md>), [confluent-cloud](<https://devfeed.tech/tags/confluent-cloud.md>), [data-loss-prevention](<https://devfeed.tech/tags/data-loss-prevention.md>), [security](<https://devfeed.tech/tags/security.md>), [security-tools](<https://devfeed.tech/tags/security-tools.md>), [soc](<https://devfeed.tech/tags/soc.md>), [streaming](<https://devfeed.tech/tags/streaming.md>)

## AI overview

This article describes an Agentic SOC that uses AI agents and a continuous streaming architecture to investigate security alerts. Its pipeline combines central triage, specialized evidence agents, adversarial evaluation, and a self-learning knowledge base to analyze every alert, escalate higher-value cases, and surface true positives for analyst review. The approach is intended to address the backlog of low-priority alerts, including Data Loss Prevention alerts, whose volume makes manual investigation impractical.

## Source excerpt

Discover how our security team built an automated multi-agent investigation pipeline that scaled alert triage throughput using a continuous streaming architecture.