Why move beyond triage?
Triage and investigation work on alerts that detection rules already raised. Two problems sit outside that loop. Some attacks raise no alert at all, which is what threat hunting is for. And many alerts come from rules that are noisy, outdated or missing, which is what detection engineering is for. A small team rarely has time for either. Vendors have noticed.
This note covers announcements and product pages we read in September and October 2026. It does not score these features; our hand-off score focuses on the alert queue.
Threat hunting agents
- Dropzone AI made its AI Threat Hunter generally available on 29 July 2026. Dropzone says it runs hypothesis-driven hunts from 270+ prebuilt hunt packs mapped to MITRE ATT&CK, across Splunk, Microsoft Sentinel, CrowdStrike NG-SIEM, Elastic and Panther.
- Prophet Security lists an AI Threat Hunter beside its AI SOC Analyst.
- Mate Security lists threat hunting among the jobs its agents run, alongside triage, investigations, response and detections.
- 7AI lists hunting on its platform page, and its Federated SIEM, announced on 27 July 2026, queries data where it lives, which suits hunts across several stores.
- Conifers' May 2026 release extended CognitiveSOC with threat hunting among other agent functions.
Detection engineering agents
- Prophet Security launched an AI Detection Engineer on 30 July 2026. Prophet says it builds a MITRE ATT&CK coverage map from a team's own detections and investigations, then writes, tunes and backtests detection rules for SIEMs including Splunk, Sumo Logic and Microsoft Sentinel. It is available to Prophet AI SOC Analyst customers.
- Mate Security describes adaptive detection engineering: detections are created, tuned or deprecated from investigation outcomes. The link between closed cases and the rules that raised them is the interesting part, because every false positive the AI SOC closes is evidence about a rule.
- Conifers lists a detection engineering agent among its five agent functions.
What this means for a lean team
The pitch is a loop: investigations show which rules are noisy, detection agents tune them, the queue shrinks, and the hours saved go to hunting. Whether that loop works depends on two things you can check.
First, who approves a rule change. A detection rule that is tuned too aggressively hides real attacks. Treat rule changes like response actions: start with recommendations, review them, and only then let the platform change rules on its own, if at all.
Second, where the rules live. If the agent writes rules into your SIEM, you keep them when you change vendors. If the rules live only inside the AI SOC, they leave with it.
Questions to ask
- Does the detection agent change rules in our SIEM, or propose changes for us to apply?
- Can we see the backtest behind each proposed change?
- How are hunt findings turned into cases, and who reviews them?
- Are hunting and detection agents included in the base subscription or priced separately?
Where this fits on this site
These agents are not part of the hand-off score today, because their public descriptions are recent and short. They are worth asking about in any demo, and we will revisit them when vendors publish more detail.
A simple test for a pilot
If a vendor offers a detection agent, give it one rule your team already knows is noisy and ask for a proposed change with its backtest. Then check the proposal against a week of real alerts. A good proposal cuts the noise without hiding the cases your team cared about. A weak one either changes nothing or removes too much. One rule is enough to see which kind you are dealing with.
Do the same for hunting: give the hunter one hypothesis from a recent industry report that matters to your sector and see what it searches, which data it reaches and how it reports a negative result. A hunt that cannot say clearly what it did not find is hard to trust when it does find something.