Agentic Threat Research is an AI-assisted workspace within Prime Architect that supports detection engineering and threat research tasks. It allows you to interact with AI through a chat-based interface by entering custom prompts or by selecting Agentic AI tools designed to guide the AI’s behavior for specific use cases. The AI model uses an internal knowledge base as the primary source of information for generating responses and combines it with user input and contextual data to generate relevant responses and outputs.
Workspace Layout
The Agentic Threat Research workspace consists of the following areas:
Left panel – Contains list of chats and projects. The panel can be collapsed or expanded.
Central chat interface – Used to create custom prompts and use agentic AI tools.
Code Editor – Located on the right side of the workspace and used for long inputs such as detection rules/queries or threat reports. Expand the section by clicking the Code Editor button.
Chat Input Options
The chat input area provides additional ways to shape and enrich your prompt. Click the + icon to see the available options.
Add Files and Images
Upload files to a chat message to give the AI agent additional context, for example, internal playbooks, incident reports, environment documentation, or other security-related reference materials. You can write your message and attach files together and the AI agent will use the attached files as context for this message. You can upload up to 3 files per message with a maximum size of 5 MB.
Supported file formats: PDF, TXT, CSV, JSON, PNG, JPG/JPEG
You can choose from a set of compatible AI tools in Prime Architect to analyze or process the attached files. If you attach a file, AI tools that don't support attachments are disabled in the tool list in chat. If you select an AI tool that doesn't support attachments, the attach file option is disabled. In both cases, hovering over the disabled control shows a tooltip explaining why.
Compatible tools:
Custom prompt
Deep Threat Research
Short Summary
Full Summary
Attack Flow
Behavior Sigma rule
Option 1: Upload manually
Click the + icon in the chat input area and select Add Files and Images.
Select a file from your device.
The file appears in the input area and begins uploading.
Option 2: Drag and drop
Locate the file on your computer (e.g., in Finder or File Explorer).
Drag the file into the chat panel in Prime Architect. You can drop it anywhere in the chat window, including the message history area or the input field.
The file attaches and begins uploading.
Option 3: Paste from clipboard
Copy an image, screenshot, or file, for example, take a screenshot, copy an image from another app, or select a file in your OS file explorer and press Cmd+C / Ctrl+C.
Click into the chat input field to make it active.
Paste using Cmd+V / Ctrl+V.
The file or image attaches automatically.
Note: If your clipboard contains both a file/image and text at the same time, only the text will be pasted, the file or image will not be attached.
Upload status
If you try to add a file that's too large or an unsupported format, an error message is displayed and the file is not attached to your message.
If an upload fails, remove the failed file or re-upload it to continue.
Depending on the size of your files, it may take a moment to process them before they’re ready to be used as context, especially for documents with many images or visual elements.
Removing a file
Click the × icon next to any uploaded file to remove it from your message before sending.
Add Skills
A skill is a reusable set of instructions that extends the capabilities of the Prime Architect agent for a specific task, guiding it to perform that task according to predefined instructions. Skills can be published by SOC Prime or other publishers, or created by users as personal skills.
Once a skill is installed, you can add it to a conversation so the agent follows its instructions when performing a relevant task. To learn how to discover skills from the library, create your own skills, and install them, follow this guide.
There are three ways to add a skill to the chat input:
Option 1: Using the + icon
Click the + icon in the chat input area and select Add Skills.
Select a skill from the list.
The skill appears in the input area, ready to be used with your next message.
Option 2: Using the / shortcut
In the chat input field, type / to search by skill name or description. A list of your installed skills appears.
Select a skill from the list.
The skill appears in the input area, ready to be used with your next message.
Option 3: Using the Agentic Skills button
Select Agentic Skills above the chat input area and select a skill from the list.
The skill appears in the input area, ready to be used with your next message.
Note: You can select only one skill per message.
A skill can be combined with other inputs in the same message, such as your own custom prompt text, a file, a detection. This lets you provide the agent with additional context or specifics alongside the skill's instructions before sending your message.
Add Detections
Search for detections from the SOC Prime Platform.
To find a detection:
Type a search term in the search bar
Select the repo to search
Apply the filters if needed
Select a detection
Once selected, it will be automatically added to the Code Editor, where you can edit rule, view translations, copy, save to a repository, or use it as an input for an AI model.
Web Search
Enable the Web Search option to allow the AI model to search the internet for relevant information in addition to its internal knowledge base, providing more up-to-date and comprehensive responses. For example, it can be used to retrieve the latest information on recent CVEs, emerging threats, new threat actor campaigns, or current cybersecurity news and research.
When the Web Search option is enabled, a corresponding icon appears in the chat input area, indicating that web search is active.
Chats and Projects
Chats can be organized into projects to be grouped under a shared context. Follow this guide to learn more.
To create a new chat, click the New Chat button on the left panel.
Existing chats and projects are displayed in the left panel. Use the search bar to search for chats or projects.
Agentic AI Tools
Agentic AI tools guide the AI model in performing specific actions. Available tools are organized into three categories: Generate, Discover, and Analyze. Each category contains a set of actions that help you perform detection engineering and threat research workflows. Select a category to view available AI tools and follow the below links to learn how to use them.
Generate
Attack Flow – Visualize adversary activity from a threat report in a structured way
Behavior Sigma Rule – Generate behavior rules in Sigma format from threat intel
Discover
Active Threats Search – Search for relevant Active Threats news items
Detections Search – Search for detections on the SOC Prime Platform
MISP Search – Query your MISP instance for threat intelligence indicators
Analyze
Short Summary – Generate a concise overview of detection logic or threat descriptions
Full Summary – Get a detailed explanation of detection logic or threat descriptions
Decision Tree – Understand how a detection rule or query works step by step
AIDEFEND Framework – Gain comprehensive insights into threats, including behavior, impact, and detection
Deep Threat Research – Analyze a threat and generate a comprehensive threat intelligence, including threat summary, related detections, malicious activity simulation, threat analysis visualizations, etc