Security alert triage and investigation agents

Company: Figma
Approach type: Agent family
Work: Security, On-call, Coding
Human involvement: Drafts reviewed
Invocation: Event-driven, Interactive
Interfaces: Slack, Github, Webhook
Deployment stage: Deployed
Evidence strength: Detailed primary
Entry reviewed: 2026-09-21

Purpose

Figma's security engineering team assembled an alert-response system from commercial parts rather than writing an agent framework: agent loops run inside Tines workflow automation on Claude models, and retrieval runs on AWS Bedrock Knowledge Bases and Amazon Kendra. Figma built the layers around them, including the Lambda handlers that index every Panther SIEM alert, intent routing to specialized agents, the scoped tool contracts, and the memory stores. A tagged Slack bot triages the alert with Okta, endpoint, Wiz, Slack, and Panther tools, delegates deeper questions to a sub-agent that writes Snowflake SQL against the security data lake, and can open pull requests against the detections repo or the monorepo.

Check the reviewed sources and claim details.

How it works

Representative workflow: Panther alert through retrieval precedent, intent routing, scoped-tool investigation, and a draft pull request the on-call engineer reviews. Research details

Index the alert and retrieve precedent

A Lambda handler converts each Panther alert into a standardized document with structured attributes and indexes it into Kendra; the next similar alert queries Bedrock for semantic matches, biased toward recent alerts and alerts carrying on-call investigation context

Post a first-pass summary and tag the bot

The Lambda stream handler posts the alert to Slack with the first-pass LLM summary and similar-alert references, then auto-tags the Tines Security Slackbot in the thread; on-call engineers can also tag the bot manually to ask follow-up questions

Route the request by intent

The tag fires a webhook into Tines, where a lighter model reads the full Slack thread and classifies the request as alert triage, a platform security question, an app approval inquiry, or something else, and routes it to a specialized agent with its own scoped tool inventory, authorization layer, and system prompt

Investigate with scoped tools

The alert triage agent pulls the actor's Okta profile and access, checks endpoint rules and events in Workshop, checks cloud findings in Wiz, reads linked Slack threads for past reasoning, and retrieves raw Panther events

Delegate data-lake questions to the investigation sub-agent

For questions the direct tools cannot answer, the triage agent passes a natural-language query to a sub-agent that writes and runs Snowflake SQL against the Panther data warehouse, which ingests AWS CloudTrail, Okta system logs, GitHub audit events, GCP audit logs, osquery endpoint telemetry, Workshop and Santa events, Wiz findings, and about a hundred other tables

Open a draft pull request for the fix

Detection rule, allowlist, and suppression changes go to the Panther detections repo, and infrastructure, service config, Terraform, RBAC, and IdP changes go to the monorepo; the agent picks up reviewer comments through a GitHub webhook, can respond or make further changes, and can rebase stale branches onto the latest master

Where people stay involved

Each scope pairs its normal attention boundary with supporting evidence. See the supervision definitions for the level mapping and limits.

Reported: Four workflows have different boundaries. The on-call engineer reviews what the triage agent found; remediation returns as a pull request that a deterministic post-step forces to draft, so the agent can open a pull request but the post never says it merges or deploys; high-confidence benign or duplicate alerts are downgraded before anyone is paged; and the post documents no review step for the non-triage intents.

Panther alert in a Slack thread → agent investigation and evidence chain → on-call engineer confirms or corrects
Work-product review · Level 3
confirmed finding → agent-authored detection, suppression, or configuration change → draft pull request review
Work-product review · Level 3
alert matching a high-confidence benign or duplicate precedent → automatic severity downgrade before anyone is paged
Exception-only · Level 5
platform security question or endpoint software approval inquiry routed to a non-triage agent
Unknown · Level unknown

Catalog interpretation: Level 3 for Panther alert in a Slack thread → agent investigation and evidence chain → on-call engineer confirms or corrects; human attention boundary: work-product-review.

Observed in July 2026

Catalog interpretation: Level 3 for confirmed finding → agent-authored detection, suppression, or configuration change → draft pull request review; human attention boundary: work-product-review.

Observed in July 2026

Catalog interpretation: Level 5 for alert matching a high-confidence benign or duplicate precedent → automatic severity downgrade before anyone is paged; human attention boundary: exception-only.

Observed in July 2026

Catalog interpretation: Unclassified for platform security question or endpoint software approval inquiry routed to a non-triage agent; human attention boundary: unknown.

Observed in July 2026

Implementation details

Model: Claude models, named by tier rather than by version. A lighter model such as Claude Sonnet performs intent routing and memory formatting; a model such as Claude Opus runs the alert triage agent and the Panther investigation sub-agent.The post names Claude Sonnet and Claude Opus as examples of the tier used at each step, hedged as "a model like"; no version is given.
Harness: Agent loops run inside Tines, a commercial workflow-automation product, which supplies the LLM loop and the explicit tool interfaces; Figma built the surrounding system: AWS Lambda handlers that index and post each Panther alert, a retrieval layer on AWS Bedrock Knowledge Bases and Amazon Kendra, webhook-triggered intent routing to specialized agents, the deterministic tool-calling contracts, and the memory stores. The core tool set is managed outside any individual agent as configuration-as-code.
Sandbox: Not reportedTines runs the agent loops and the sub-agent executes SQL against Snowflake, but no execution isolation boundary is described; the legacy unknown claim stays in research details.
Tool access: Each routed agent has its own scoped tool inventory and authorization layer. The alert triage agent's tools cover Okta profiles, groups, and login history; North Pole Security Workshop rule and event search, host sync status, and rule push for the Santa endpoint agent; Wiz audit logs, inventory, findings, and exposed resources; Slack thread reads, profile lookups, and progress updates; Panther alert details, raw triggering events, and related alerts; opening pull requests in the Panther detections repo or the monorepo; and delegation to the Panther investigation sub-agent.
Knowledge: Case memory is the Kendra and Bedrock corpus of past alerts plus investigation context, which is the comment an on-call engineer leaves in the Slack alert thread or the Asana ticket and which is indexed back onto the original alert. Retrieval is biased toward recent alerts and alerts that carry investigation context. The investigation sub-agent keeps a separate procedural memory store organized by data-source tags such as aws, okta, osquery, and workshop, holding schema findings written by a lighter model. Tines database records hold stateful objects such as open agent-created pull requests and Panther investigation state.
Context management: The triage agent receives the full Slack thread history plus its steering-memory markdown document, loaded into context at the start of every run. It has no ambient access to whole Slack channels, and outside direct messages it can read a thread only when it is re-tagged on the latest message.
Credentials: Authorization controls limit the agents to security team members, and Figma states that the agent works on behalf of an authorized team member and that its tools are scoped, authorized, and monitored. Pull requests the agent opens are authored by a service account, so the PR description carries the requesting engineer's name and a link to the originating Slack thread. The post does not document how the agent authenticates to each connected system.Authorization scoping, the service-account pull-request identity, and the on-behalf-of rule are stated; the authentication mechanism for each connected system is not.
Interfaces: slack, github, webhookAlert summaries also reach Asana tickets and investigation context is indexed from them, but Asana is not an interface value in the schema.

Mechanisms

Alert-to-resolution loop

Panther alert → retrieval summary and precedent → intent routing → scoped-tool investigation → draft pull request

Segment memory by precedent, policy, state, and schema

Case memory holds past alerts and investigation context, steering memory holds behavioral rules the agent can update when an engineer corrects it, Tines database records hold stateful objects, and the sub-agent's tagged procedural memory holds schema findings it saves after a discovery query

Validation and failure handling

Enforce deterministic tool-call safeguards

Every pull request the agent creates is set to draft by a deterministic post-step in the Tines workflow rather than by a prompt instruction, and the same tool-calling contract keeps sensitive employee information out of Okta responses and stops the agent closing or modifying pull requests it did not author

Reported observations

The catalog records what the sources report, with the scope and the denominator of every figure. A qualification below limits the figure it sits under.

Cost latency · Estimate · Time-to-resolution on complex security alerts handled by the agent system

Headline claim

“Around 70% reduction in time-to-resolution on complex alerts, reported by Figma in July 2026”

Reported by: Figma
Scope: Time-to-resolution on complex security alerts handled by the agent system