SOCRadar AI Agents: Your Digital Team

Threat Actor-Ransomware Master Agent

Adversary Intelligence Specialist

Cyber Threat Intelligence 19 skills

Answers who is behind a threat: the groups, their victims, their tooling and their current activity.

Appears on: Campaigns · Threat Actors

Skill	What it does
Threat Actor – Search Threat Actor	A complete intelligence profile of a named threat actor: who they are, who they target, and their latest campaigns, victims and IOCs.
Threat Actor – Search Ransomware Group	A complete intelligence profile of a named ransomware group: who they are, their victims, and their latest activity and IOCs.
Ransomware Group Directory	Lists the ransomware groups SOCRadar tracks, most active first, with the name and id of each one. Search by name to find a specific group.
Ransomware Groups by Country	Which ransomware groups are targeting a given country, each with a short summary.
Threat Actor Dossier	Who a group is, what they have run, and the indicators tied to them, in one pass.
Threat Actor by Country	Which threat actor groups are targeting a given country, each with a short summary.
Threat Actor Victims	Who a given group has claimed as a victim.
Threat Actor by Industry	Which threat actor groups are targeting a given industry, each with a short summary.
Threat Actor Detection Rules	The detection content the platform ships for a given group.
Ransomware Group by Industry	Which ransomware groups are targeting a given industry, each with a short summary.
Threat Actor News	What has been published about a group, optionally within a date range.
Ransomware Victims by Country	The latest organizations breached or ransomed in a given country, newest first.
Published Victims	Recently published ransomware victims, with the shape of the activity behind them.
Ransomware Victims by Industry	The latest organizations breached or ransomed in a given industry, newest first.
Global Threat Trends	The most amplified CVEs and most active groups right now, worldwide.
Cyber Trends – Industry Details	An industry threat-landscape snapshot: key metrics plus the top attack types, actors, countries and CVEs.
Critical Security News	The security news that actually matters, filtered to high impact.
Cyber Trends – Country Details	A country threat-landscape snapshot: key metrics plus the top attack types, actors, industries and CVEs.
Weekly Security News	A week of security news, searchable by keyword.

Detection Engineering Agent

Detection Engineering

Cyber Threat Intelligence 8 skills

Turns threat intelligence into detection content in whichever language your stack speaks.

Appears on: IoC Radar · Threat Hunting Rules

Skill	What it does
YARA Rule Generator	Writes YARA rules that match malicious files and memory from a threat description or a list of indicators, then reviews the draft and reports what it corrected.
Sigma Rule Generator	Writes Sigma rules, the portable detection format that converts to most SIEM backends from a threat description or a list of indicators, then reviews the draft and reports what it corrected.
AQL Query Generator	Writes IBM QRadar Ariel Query Language searches from a threat description or a list of indicators, then reviews the draft and reports what it corrected.
KQL Query Generator	Writes Microsoft Sentinel and Defender XDR Kusto queries from a threat description or a list of indicators, then reviews the draft and reports what it corrected.
SPL Query Generator	Writes Splunk Search Processing Language searches from a threat description or a list of indicators, then reviews the draft and reports what it corrected.
Snort and Suricata Rule Generator	Writes Snort and Suricata network intrusion detection signatures from a threat description or a list of indicators, then reviews the draft and reports what it corrected.
Detection Rule Converter	Converts a detection rule between formats – Sigma, YARA, KQL, SPL, AQL, Suricata – and reports anything the target format cannot express.
Detection Rule Review	Reviews an existing detection rule for false positives, evasion gaps and syntax, and returns an improved version with the reasoning.

IoC Enrichment Master Agent

Tactical Threat Analyst

Cyber Threat Intelligence 5 skills

Takes an indicator you are unsure about and returns one consolidated verdict on it.

Skill	What it does
Enrich IoC	Takes any indicator (domain, IP, file hash or URL), works out which kind it is, and returns one consolidated reputation and risk read on it.
IOC Enrich – URL	Performs an in-depth indicator of compromise (IoC) lookup on a given URL by aggregating threat intelligence signals from multiple security feeds, sandbox detonations, and reputation engines. Returns a consolidated risk verdict along with associated malware families, detection categories, related artifacts, and historical observations to support triage, investigation, and response workflows.
IOC Enrich – Hash	Checks a file hash against malware repositories, sandbox execution data and antivirus verdicts, and reports whether the file belongs to a known campaign: its malware family, its behaviour, the indicators tied to it and when it was first and last seen.
IOC Enrich – IP	Investigates an IP address against multi-source threat intelligence including blocklists, passive DNS, geolocation, ASN ownership, and historical attack telemetry to assess its reputation and exposure profile. Returns a unified risk verdict enriched with associated malware, hosted domains, network metadata, and related indicators to support detection engineering, blocking decisions, and incident triage.
IOC Enrich – Domain	Conducts a deep IoC investigation on a domain by correlating threat feeds, passive DNS history, WHOIS data, hosting infrastructure, and malware associations to determine its reputation and operational risk. Returns a consolidated verdict alongside resolved IPs, related malicious artifacts, registration details, and threat actor linkages to support investigation, attribution, and proactive defense.

Identity Intelligence Agent

Identity Sentinel

Cyber Threat Intelligence 4 skills

Watches the credentials and identities tied to your people, your executives and your suppliers.

Appears on: Breach Datasets · Identity & Access Intelligence

Skill	What it does
Check Third Party Risk	Checks the identity exposure attached to your suppliers and third parties, so a partner’s breach does not become yours unnoticed.
Check Latest Identity Risks	Reviews the identity exposures that appeared most recently, both leaked credentials and stealer-log records, and reports which ones still open a door.
Check Employee Risks	Reviews the exposure tied to your own employees’ addresses: what leaked, from where, and what should be rotated.
Employee Exposure Timeline	Shows everything SOCRadar holds on one employee address over the last few years: when each credential was stolen, which services it opened, and every infected machine behind those records.

Vulnerability Agent

Proactive Threat Emulation Specialist

Cyber Threat Intelligence 3 skills

Answers what a vulnerability is, whether it is being exploited, and whether it should worry you.

Appears on: Vulnerability Intelligence

Skill	What it does
Analyze the Vulnerability – CVE	Assesses one named CVE: what it breaks, how it is exploited, whether it is being used in the wild, and what it means for you.
Vulnerability Search	Finds CVEs matching a product, vendor or keyword.
CVE Trends	Which CVEs the world is talking about right now.

Social Media Master Agent

Cross-Platform Brand Watch

Digital Risk Protection 17 skills

Searches every social platform SOCRadar can reach for a name, in one pass.

Skill	What it does
Instagram Profiles Scan	Finds Instagram accounts whose username or name matches a keyword and returns their follower counts, bios and verification status.
Instagram Posts Scan	Finds public Instagram posts that mention a keyword and returns their captions, hashtags and engagement counts.
X Profiles Scan	Finds accounts on X whose handle or name matches a keyword and returns their follower counts, bios and verification status.
X Content Scan	Finds posts on X that mention a keyword and returns their text, engagement counts and author handles.
TikTok Profiles Scan	Finds TikTok accounts whose username or name matches a keyword.
YouTube Channels Scan	Finds YouTube channels whose name matches a keyword.
Facebook Profiles Scan	Finds Facebook profiles whose name matches a keyword and returns their public profile details.
Facebook Pages Scan	Finds Facebook pages whose name matches a keyword.
Facebook Groups Scan	Finds Facebook groups whose name matches a keyword.
Facebook Posts Scan	Finds Facebook posts that mention a keyword and returns their text, author and engagement counts.
Meta Ads Scan	Finds ads running on Facebook and Instagram that mention a keyword and returns their text, advertiser and destination links.
Pinterest Profiles Scan	Finds Pinterest accounts whose username or name matches a keyword and returns their follower, board and pin counts.
Reddit Posts Scan	Finds Reddit posts that mention a keyword and returns their title, subreddit, score and comment counts.
Bluesky Profiles Scan	Finds Bluesky accounts whose handle or name matches a keyword and returns their follower and post counts.
Bluesky Posts Scan	Finds Bluesky posts that mention a keyword and returns their text, author and engagement counts.
Snapchat Profiles Scan	Finds Snapchat accounts whose username or name matches a keyword and returns their follower counts.
LinkedIn Profiles Scan	Finds LinkedIn profiles whose name matches a keyword.

DRPS – Brand Monitoring Agent

Brand Abuse Monitoring

Digital Risk Protection 8 skills

Tracks the ways your brand is being abused, and records the decision you take on each.

Appears on: Rogue Mobile Applications · Impersonating Accounts · Takedown Management · Social Media Findings · Impersonating Domains

Skill	What it does
Brand Exposure Overview	Counts every kind of brand abuse SOCRadar is tracking – impersonating domains and accounts, rogue apps, bad reputation entries and social media findings – and shows how much of it still needs a decision.
Fraud Detections	Fraud findings such as stolen cards and fraudulent use tied to your company.
Impersonating Domains	Lists the domains registered to look like the company’s own, newest window first, with the detail needed to decide what to do about each one.
Impersonating Accounts	Lists the social accounts pretending to be the company, newest window first, with the detail needed to decide what to do about each one.
Rogue Mobile Applications	Lists the applications published in the company’s name that it did not publish, newest window first, with the detail needed to decide what to do about each one.
Social Media Findings	Lists the posts and chatter naming the company on social platforms, newest window first, with the detail needed to decide what to do about each one.
Bad Reputation	Lists the company assets that have landed on a public blacklist, newest window first, with the detail needed to decide what to do about each one.
Surface Web Findings	Lists the company data exposed on the open web, most often in public code repositories, newest window first, with the detail needed to decide what to do about each one.

DRPS – Dark Web Agent

Dark Web Monitoring

Digital Risk Protection 8 skills

Tracks what is circulating about you on the dark web, and what still needs a decision.

Appears on: Botnet Data · Black Market · PII Exposure · Suspicious Content · IM Content

Skill	What it does
Dark Web Exposure Overview	Counts what SOCRadar has found about the company on the dark web – botnet logs, black market listings, leaked personal data, suspicious content and messaging chatter – and how much still needs a decision.
VIP Leaks	Leaked data belonging to your executives and VIPs.
Dark Web News Digest	News drawn from dark web sources.
Black Market Listings	Lists the company data being sold on black markets, newest window first, with the detail needed to decide what to do about each one.
PII Exposure	Lists the employee and customer identities exposed in breaches, newest window first, with the detail needed to decide what to do about each one.
Botnet Data	Lists the credentials harvested from machines infected by stealer malware, newest window first, with the detail needed to decide what to do about each one.
Suspicious Content	Lists the dark web pages and forum posts naming the company, newest window first, with the detail needed to decide what to do about each one.
Instant Messaging Content	Lists the chatter about the company on Telegram and other messaging platforms, newest window first, with the detail needed to decide what to do about each one.

Phishing Master Agent

Phishing Threat Interceptor

Digital Risk Protection 5 skills

Finds the sites impersonating your brand and follows their fingerprints to the rest of the infrastructure.

Appears on: Impersonating Accounts · Impersonating Domains

Skill	What it does
Brand Impersonation Campaign – Indicator Intelligence	Finds the sites impersonating your brand, shows the pattern that links them, and names who to send each takedown to.
URLScan Indicator Yield	Reads a site’s own public scan and returns only the signals that measure tight enough to hunt with.
URLScan Indicator Expansion	Takes one indicator and returns the domains carrying it in a date range, with what each one serves.
URLScan Query Builder	Turns a question into urlscan.io searches, using only fields that were measured to exist.
URLScan Query Runner	Runs urlscan searches and reports how much each one actually returns, so a query is measured before it is trusted.

Attack Surface Agent – ASM

External Attack Surface

Attack Surface Management 12 skills

Reports what your organisation exposes to the internet, and what is wrong with it.

Appears on: Digital Footprint · Company Vulnerabilities

Skill	What it does
Attack Surface Overview	Summarises everything SOCRadar sees of a company from the outside: how many assets of each kind are exposed, how many open vulnerabilities they carry, and which CVEs to look at first.
Vulnerability Triage	Ranks the open vulnerabilities by how much work they actually represent, so the team knows what to patch first and which assets each fix touches.
Asset Inventory	Lists the assets discovered for your company, filterable by type.
CVE Impact Check	Answers whether a named CVE is present on the company’s assets, on how many, and which ones – the question that gets asked the moment a vulnerability makes the news.
ASM Vulnerability List	The vulnerabilities found on your discovered assets.
New Exposure This Period	Reports what appeared on the attack surface in a chosen period: newly discovered assets by type, and the open vulnerabilities found on them.
CVE Backlog	Groups the open findings by CVE so you can see which flaw accounts for the most exposure.
Asset Deep Dive	Pulls together everything the platform knows about one asset: how it was discovered, what runs on it, its open findings, alarms and security score.
Vulnerabilities by Asset	Groups open findings by asset, so you can see which machines carry the most risk.
Vulnerability Backlog Age	How old the open findings are, bucketed, so ageing risk is visible.
Daily Exposure Pulse	One combined read of today’s alarm load and the open vulnerability position.
Vulnerability Posture Report	A full picture of your open vulnerabilities: how many there are, how severe they are, how long they have been sitting, which flaws reach the most assets and which assets carry the most. The complete CVE and asset lists download as CSV.

Shodan Recon Agent

Shodan Recon

Attack Surface Management 9 skills

Queries Shodan against a target and pivots on what it finds.

Skill	What it does
Shodan Dork Generator	Generates and sizes Shodan search queries for a target.
Shodan Dork Runner	Runs a Shodan search query and returns the matching hosts.
Shodan Host Lookup	Shows everything Shodan knows about a single IP address.
Shodan IP Block Finder	Lists a target’s owning ASNs and IP blocks.
Shodan Facet Query	Gives an aggregate breakdown for a Shodan query.
Shodan Critical Exposure Finder	Finds critical internet exposures for a target.
Shodan Banner Keyword Finder	Finds hosts whose banner mentions a keyword.
Shodan Favicon Hash Finder	Finds hosts that share a favicon hash.
Shodan JARM Finder	Finds hosts that share a JARM TLS fingerprint.

Digital Asset Reconnaissance Agent

Digital Reconnaissance Specialist

Attack Surface Management 7 skills

Maps what a domain or IP address actually resolves to, on demand.

Skill	What it does
Attack Surface Intelligence – IP Address Insight	Looks up an IP address and returns the domains, ports and services associated with it.
Attack Surface Intelligence – Find Subdomains	Discovers the subdomains published under a domain.
Attack Surface Intelligence – Domain Insight	Looks up a domain and returns what it resolves to and what sits behind it: subdomains, ports, services and related records.
Attack Surface Intelligence – Related Domain, Whois Enumeration	Finds domains related to the one you give it through shared WHOIS registration details.
Attack Surface Intelligence – Related Domains	Finds the other domains that appear to belong to the same owner.
Attack Surface Intelligence – Subdomain Details	Returns the detail behind a discovered subdomain: what it resolves to and what it is running.
Attack Surface Intelligence – Find IP Address for Domain	Resolves a domain to the IP addresses currently serving it.

Mobile App Finder

Mobile Ecosystem Navigator

Cross Platform 2 skills

Finds an app on the public app stores by name, brand or developer.

Skill	What it does
Google Play Store – Mobile App Search	Searches Google Play for mobile apps matching a keyword and returns the matching apps with their developer and store link.
App Store – Mobile App Search	Searches the Apple App Store for mobile apps matching a keyword and returns the matching apps with their developer and store link.

Alarm Agent

Adaptive Incident Analyst

Alarm Management 16 skills

Reads your alarms, decides what they mean, and reports what your queue actually looks like.

Appears on: Incidents · Dashboard

Skill	What it does
Alarm Analyze and Take Action	Analyses one alarm, shows you the verdict, and asks before it changes anything. You decide whether the status moves; your note is recorded on the alarm either way.
Analyze the Latest Alarms	Triages the newest open alarms one at a time and records its verdict as a comment on each. It reads and comments only; no alarm status is changed.
Alarm Volume Summary	How many alarms arrived over a period, and how that compares with the period before.
Alarm Insight	A short read on a single alarm: what it is about, what the platform already knows, and how urgent it looks.
Alarm Breakdown	Splits alarms by type, severity or status so you can see where the volume sits.
Daily Alarm Timeline	A day-by-day count of alarms across the period you choose.
Alarm Arrival Profile	Shows which hours of the day alarms actually arrive in.
Triage Coverage	How much of the alarm load has actually been reviewed, and how much is still untouched.
First-Seen Alarm Types	Alarm types that fired on this account for the first time.
Keyword Load	Which monitored keywords are generating the most alarms.
Vulnerability Alarms	The alarms raised specifically about vulnerabilities.
External Event Alarms	Alarms raised by things happening outside your perimeter rather than on your assets.
Supply Chain Watch	Cross-references your supplier alarms with who is being published as a victim globally.
Daily SOC Brief	Covers one full day of alarms for a shift handover: how the volume compared with normal, when the alarms arrived, what stood out, which CVEs were raised, what is still open, and what the wider world was dealing with.
Security Posture Analysis	Builds one report covering your alarms, your open vulnerabilities and the outside events that named you, written in layers so an executive, a security manager and an analyst each find their own section.
Alarm Analytics	Builds a report page and a day-by-day spreadsheet showing how your alarm volume moved over a period, which alarm types and keywords drove it, and how it compares with the period before.