Prophet Security Prophet Security Integration

TL;DR

Overview

Prophet Security is an agentic AI SOC platform that autonomously triages, investigates, and responds to security alerts ingested from a customer's SIEM, EDR, identity provider, email security, and other tools. These logs capture the full audit trail of each AI-driven investigation: the initial alert ingestion, context enrichment steps (e.g., Active Directory/Okta user lookups), threat intelligence lookups (e.g., VirusTotal), the AI agent's reasoning, and the final verdict/summary (True Positive, False Positive, or Benign) with a confidence score. This data is valuable for security operations because it provides visibility into how an AI SOC analyst reasoned about and disposed of alerts, enabling audit of automated triage decisions, detection of missed threats, and measurement of AI investigation quality and coverage. Integrating these logs with Hunters allows security teams to correlate Prophet Security's AI-driven verdicts with other data sources and maintain a centralized, searchable record of automated investigation activity.

Supported data types

Prophet Security AI SOC Investigations

Table name: prophet_security_investigations

This data type contains the full audit trail of AI-driven security investigations performed by Prophet Security, including the triggering alert, enrichment and threat intelligence lookup steps, the agent's reasoning, and the final verdict with a confidence score. Each investigation is represented as a sequence of JSON records sharing a common investigation_id, consisting of one summary/verdict record and multiple audit-step records that detail the investigation workflow.

Expected format

Logs are expected in JSON format.

{"investigation_id": "inv_341829500", "timestamp": "2026-11-03T22:15:00Z", "status": "Completed", "verdict": "True Positive", "confidence_score": 0.8, "summary": "Identified potential AiTM session hijacking via atypical travel pattern."}

Send data to Hunters

Hunters supports the collection of Prophet Security logs using S3 List.

To connect Prophet Security logs:

1. Route Prophet Security logs into an AWS S3 bucket.
2. Once logs are in S3, follow the steps in this section.