# Streamlining Security Investigations with Agents

DevFeed: [Streamlining Security Investigations with Agents](<https://devfeed.tech/articles/streamlining-security-investigations-with-agents-153.md>)

Original publisher: [Read original article](<https://slack.engineering/streamlining-security-investigations-with-agents/>)

Author: Dominic Marks

Published: 2025-12-01T16:00:42Z

Content type: article

Language: en

Sources: [Engineering at Slack](<https://devfeed.tech/sources/engineering-at-slack.md>)

Topics: [AI Chat](<https://devfeed.tech/topics/ai-chat.md>), [MSP MCP](<https://devfeed.tech/topics/msp-mcp.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [coding](<https://devfeed.tech/tags/coding.md>), [data](<https://devfeed.tech/tags/data.md>), [design](<https://devfeed.tech/tags/design.md>), [development](<https://devfeed.tech/tags/development.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [events](<https://devfeed.tech/tags/events.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [manifest](<https://devfeed.tech/tags/manifest.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [performance](<https://devfeed.tech/tags/performance.md>), [security](<https://devfeed.tech/tags/security.md>), [series](<https://devfeed.tech/tags/series.md>), [slack](<https://devfeed.tech/tags/slack.md>), [software-engineering](<https://devfeed.tech/tags/software-engineering.md>), [uncategorized](<https://devfeed.tech/tags/uncategorized.md>)

## AI overview

Slack Security Engineering describes an AI-agent prototype for investigating security alerts. To improve consistency and control beyond prompt refinement, the team decomposes investigations into chained model invocations with defined purposes and output structures, and exposes selected data sources through an stdio MCP server.

## Source excerpt

Slack's Security Engineering team is responsible for protecting Slack's core infrastructure and services. Our security event ingestion pipeline handles billions of events per day from a diverse array of data sources. Reviewing alerts produced by our security detection system is our primary responsibility during on-call shifts. We're going to show you how we're using AI...