Workshop: Turn Security Workflows into AI Agents

You already know how to do useful security work. How do you get an agent to help? In this four-hour, hands-on workshop, we’ll take a familiar workflow from an idea on paper to a working agent you can use.[ER1]

Each exercise adds a capability to the same agent. You’ll give it a task, follow its tool calls, test its permissions, and inspect its results. Along the way, we’ll capture a procedure in a skill and decide what ordinary code should calculate, where a model can contribute judgment, and where you need to stay in control.

A supplied threat hunting case makes these decisions concrete, but the method applies across defensive work, including alert triage, incident response, and detection engineering. No threat hunting or programming experience is required. All code is supplied and ready to run.

You’ll leave with working examples and a practical process for identifying where an agent can help with your own work, connecting it to the tools it needs, and producing structured results you can check and use.

This is a standalone workshop; Build Your Own AI Security Agent is not a prerequisite. Returning students will find a new, focused experience built around taking one workflow all the way to a working agent.

Who Should Take This Workshop

This workshop is for defenders who want to take a task they already know how to do and get an agent to help with it. Whether your work involves triaging alerts, investigating incidents, evaluating detections, or gathering context for a decision, you’ll learn a practical method for deciding where an agent fits and how to put it to work.

• SOC analysts and incident responders interested in using agents to assist with repeatable investigative work and produce findings they can inspect and review.
• Security engineers responsible for evaluating or integrating AI capabilities into internal tooling, who want to understand how tools, permissions, skills, and structured results fit together.
• Detection engineers and threat hunters who want to connect their procedures and analysis tools to an agent, while retaining control over how evidence is gathered and interpreted.
• Blue-team leads and security architects deciding where agents could help their teams, which responsibilities should stay with deterministic code, and where human judgment remains essential.
• Practitioners who have experimented with AI tools but want a clearer method for turning a familiar security task into a practical, bounded workflow.
• Security generalists new to agent engineering who would benefit from a guided, hands-on introduction grounded in a recognizable security problem.

What You’ll Learn

By the end of this workshop, you’ll be able to

• Break down a security workflow into clear responsibilities. Identify the work that belongs in deterministic code, the interpretation a model can assist with, and the decisions that should remain with an analyst.
• Explain how a harness turns a model conversation into useful work. Follow how it supplies context, makes model calls, handles tool requests, returns results to the conversation, and determines when to stop.
• Explain how a procedure becomes a skill. Connect a written workflow to instructions describing the evidence to gather, the tools to use, the questions to consider, and the limits of the task.
• Run a complete agent-assisted workflow. Use the supplied system to carry out a task through local functions, a constrained command-line tool, and an MCP connection.
• Distinguish measurement from interpretation. See why repeatable analysis belongs in code, then examine how the model uses those measurements and additional context to explain what the evidence may mean.
• Explain how the harness enforces tool boundaries. Inspect allowed and rejected requests, including checks on tool arguments and investigation scope, and understand why instructions alone are not permissions.
• Work with a structured investigation result. Inspect an object with defined fields for the assessment, evidence, explanation, limitations, and follow-up; see how validation and bounded retries handle incorrectly formatted output.
• Review the findings as an analyst. Distinguish a valid output format from a well-supported conclusion, compare benign and suspicious activity, and recognize when the available evidence is insufficient.
• Plan how the same method could support another security task. Identify the procedure, evidence sources, analysis tools, execution boundaries, and human review points that another workflow would need.