SIEM and SOC Platforms: from ArcSight to AI agents

The SIEM started as a box in the data center. ArcSight and Q1 Labs QRadar collected syslog and event data from firewalls, IDS sensors and servers, normalized it, and ran correlation rules over it. Gartner analysts named the category SIEM in 2005, merging security information management and security event management into one term.

The big vendors bought in. HP closed its roughly $1.5 billion ArcSight deal in October 2010, and IBM completed its Q1 Labs acquisition in October 2011 and built a security division around QRadar. The pitch was a single pane of glass. The reality was an appliance that needed a dedicated team to keep running.

Correlation rules were hand written. Every new data source meant a new parser, and every new attack meant a new rule. Storage was expensive, so teams kept 30 to 90 days of logs and dropped the rest. Much of the deployment budget was justified by compliance: PCI and SOX auditors wanted log retention and review, and the SIEM was the receipt.

What broke was the human at the end of the pipe. Rules fired thousands of alerts, a tier-1 analyst opened each one, pivoted across four consoles, and closed most as noise. I built SOC 2, PCI and ISO programs at Sageworks, and log review was the control everyone could prove they owned and almost nobody could prove they did well. The manual triage queue was born here.

Splunk changed the economics first. It indexed any machine data without a fixed schema, and in October 2013 it made Splunk Cloud generally available on AWS. Search replaced rigid correlation for many teams. The bill moved to data volume, which meant every new log source became a budget fight.

The cloud natives followed. Alphabet's Chronicle launched Backstory in March 2019 to search petabytes of security telemetry, and Microsoft made Azure Sentinel, now Microsoft Sentinel, generally available in September 2019 as a cloud SIEM priced on ingestion. Elastic offered the open stack for teams that wanted to run it themselves.

SOAR arrived to automate the repetitive work around alerts. Splunk closed its roughly $350 million Phantom acquisition in April 2018, and Palo Alto Networks built Cortex XSOAR on the same idea. Playbooks enriched an IP, pulled a user's recent logins, or quarantined a host on a trigger.

What broke was the playbook. It only handled what someone had already written down, and it broke when an API changed. Alert volume kept climbing as companies added SaaS apps and cloud accounts, and the tier-1 queue grew faster than headcount. Automation saved clicks. It did not replace judgment.

Machine learning had been in SIEMs for years as user behavior analytics, scoring anomalies on top of rules. Generative AI changed the interface. Microsoft announced Security Copilot in March 2023 and made it generally available in April 2024, priced by security compute unit. CrowdStrike introduced Charlotte AI in May 2023 as a generative assistant for Falcon.

The copilot did real work for analysts. It summarized incidents, translated plain questions into KQL or SPL, explained a suspicious script, and drafted the incident report. Microsoft claimed analysts using it worked 22% faster and 7% more accurately in its own studies. Every vendor shipped one, which is the shift the AI security copilots prediction tracks.

The market consolidated around data platforms. Google bought Siemplify in 2022 and folded it into Chronicle, now Google Security Operations. Cisco completed its Splunk acquisition in March 2024. Exabeam and LogRhythm merged in July 2024, and Palo Alto Networks took over IBM's QRadar SaaS business in September 2024 and offered customers a path to Cortex XSIAM.

What broke was the premise that a faster human was enough. A copilot waits for a prompt. The analyst still opened every alert, still decided, and still clicked. Attackers were using the same models to move faster, a pattern I covered in how AI compresses the vulnerability lifecycle.

In 2025 the copilot stopped waiting for a prompt. CrowdStrike made Charlotte AI Detection Triage generally available in February 2025 and says it matches its own MDR analysts' triage decisions more than 98% of the time. Microsoft announced Security Copilot agents in March 2025, led by a Phishing Triage Agent in Defender, and from November 2025 began including Security Copilot in Microsoft 365 E5. Google says its Triage and Investigation Agent in Google SecOps has worked more than 5 million alerts.

Here is what these agents do in production. When an alert fires, the agent pulls context, detonates files and URLs, queries threat intelligence, runs hunting queries across data sources, and writes a verdict with its reasoning. Microsoft's documentation is precise about the boundary: the phishing agent resolves false positives itself and leaves true positives open for an analyst. Google's agent classifies and explains; containment stays with people or with deterministic playbooks.

Agent-native startups push further. Torq raised a $140 million Series D in January 2026 for an AI SOC that triages, investigates and can remediate autonomously or with oversight. Dropzone AI, 7AI and Prophet Security sell AI SOC analysts that sit on top of an existing SIEM. Palo Alto Networks relaunched XSOAR as Cortex AgentiX in October 2025, where admins decide which actions need approval.

The limits are real. Agents are strong at triage and evidence gathering and weak at business context: whether that VP really logs in from that country. Every one of them runs with an identity and permissions, which is why Palo Alto paid $25 billion for CyberArk and Microsoft wires these agents to Entra Agent IDs. Most vendors do not publish how to stop an agent mid-action, a gap I measured in the kill switch test.

My bet: by 2031 the autonomous SOC is the default for tier-1 and most tier-2 work. Agents will triage and investigate virtually every alert, close the noise, and execute pre-approved containment such as isolating a laptop or revoking a session. A human approves anything that touches production systems, executives, customers or legal exposure.

The SIEM itself becomes a data layer. Detection, investigation and response move into agents that read from a security data lake, and the per-gigabyte SIEM license gives way to pricing per investigation or per outcome. Google, Microsoft, CrowdStrike, Palo Alto Networks and Cisco are each building that stack, and the startups will either plug into it or be bought by it.

For this to happen, three things must be true. Agent identity has to be solved: every SOC agent gets its own scoped credential, short-lived tokens, and a log of every action tied to that identity. Verdict quality has to be measured independently, not self-reported. And security leaders need a way to prove to auditors and boards that an agent's decision was reviewable. Without that, regulated companies will keep a human on every action, and the shift stalls at triage.