Security alert triage and investigation agents
Figma's security engineering team assembled an alert-response system from commercial parts rather than writing an agent framework: agent loops run inside Tines workflow automation on Claude models, and retrieval runs on AWS Bedrock Knowledge Bases and Amazon Kendra. Figma built the layers around them, including the Lambda handlers that index every Panther SIEM alert, intent routing to specialized agents, the scoped tool contracts, and the memory stores. A tagged Slack bot triages the alert with Okta, endpoint, Wiz, Slack, and Panther tools, delegates deeper questions to a sub-agent that writes Snowflake SQL against the security data lake, and can open pull requests against the detections repo or the monorepo.
- Company
- Figma
- Approach type
- Agent family
- Human involvement
- Varies by scope: Work-product review, Exception-only, Unknown. See each scope.
- Invocation
- Event-driven, Interactive
- Interfaces
- Slack, Github, Webhook
- Deployment stage
- Deployed
- Evidence strength
- Detailed primary
- Entry reviewed
How it works
Panther alert through retrieval precedent, intent routing, scoped-tool investigation, and a draft pull request the on-call engineer reviews.
A Lambda handler converts each Panther alert into a standardized document with structured attributes and indexes it into Kendra; the next similar alert queries Bedrock for semantic matches, biased toward recent alerts and alerts carrying on-call investigation context[Source 1]
The Lambda stream handler posts the alert to Slack with the first-pass LLM summary and similar-alert references, then auto-tags the Tines Security Slackbot in the thread; on-call engineers can also tag the bot manually to ask follow-up questions[Source 1]
The tag fires a webhook into Tines, where a lighter model reads the full Slack thread and classifies the request as alert triage, a platform security question, an app approval inquiry, or something else, and routes it to a specialized agent with its own scoped tool inventory, authorization layer, and system prompt[Source 1]
The alert triage agent pulls the actor's Okta profile and access, checks endpoint rules and events in Workshop, checks cloud findings in Wiz, reads linked Slack threads for past reasoning, and retrieves raw Panther events[Source 1]
For questions the direct tools cannot answer, the triage agent passes a natural-language query to a sub-agent that writes and runs Snowflake SQL against the Panther data warehouse, which ingests AWS CloudTrail, Okta system logs, GitHub audit events, GCP audit logs, osquery endpoint telemetry, Workshop and Santa events, Wiz findings, and about a hundred other tables[Source 1]
Detection rule, allowlist, and suppression changes go to the Panther detections repo, and infrastructure, service config, Terraform, RBAC, and IdP changes go to the monorepo; the agent picks up reviewer comments through a GitHub webhook, can respond or make further changes, and can rebase stale branches onto the latest master[Source 1]
Where people stay involved
People review, approve, or guide the agent’s work here.
Reported: Four workflows have different boundaries. The on-call engineer reviews what the triage agent found; remediation returns as a pull request that a deterministic post-step forces to draft, so the agent can open a pull request but the post never says it merges or deploys; high-confidence benign or duplicate alerts are downgraded before anyone is paged; and the post documents no review step for the non-triage intents.
Supervision level
Work-product review
A person reviews the draft or implementation.
Level 3 of 5
Supervision level
Exception-only
A person returns when the system raises an exception.
Level 5 of 5
- alert matching a high-confidence benign or duplicate precedent → automatic severity downgrade before anyone is paged[Source 1]
Supervision level
Not classified
- platform security question or endpoint software approval inquiry routed to a non-triage agent[Source 1]
Implementation details
- Model
- Claude models, named by tier rather than by version. A lighter model such as Claude Sonnet performs intent routing and memory formatting; a model such as Claude Opus runs the alert triage agent and the Panther investigation sub-agent.[Source 1]The post names Claude Sonnet and Claude Opus as examples of the tier used at each step, hedged as "a model like"; no version is given.
- Harness
- Agent loops run inside Tines, a commercial workflow-automation product, which supplies the LLM loop and the explicit tool interfaces; Figma built the surrounding system: AWS Lambda handlers that index and post each Panther alert, a retrieval layer on AWS Bedrock Knowledge Bases and Amazon Kendra, webhook-triggered intent routing to specialized agents, the deterministic tool-calling contracts, and the memory stores. The core tool set is managed outside any individual agent as configuration-as-code.[Source 1]
- Sandbox
- Not reportedTines runs the agent loops and the sub-agent executes SQL against Snowflake, but no execution isolation boundary is described.
- Tool access
- Each routed agent has its own scoped tool inventory and authorization layer. The alert triage agent's tools cover Okta profiles, groups, and login history; North Pole Security Workshop rule and event search, host sync status, and rule push for the Santa endpoint agent; Wiz audit logs, inventory, findings, and exposed resources; Slack thread reads, profile lookups, and progress updates; Panther alert details, raw triggering events, and related alerts; opening pull requests in the Panther detections repo or the monorepo; and delegation to the Panther investigation sub-agent.[Source 1]
- Knowledge
- Case memory is the Kendra and Bedrock corpus of past alerts plus investigation context, which is the comment an on-call engineer leaves in the Slack alert thread or the Asana ticket and which is indexed back onto the original alert. Retrieval is biased toward recent alerts and alerts that carry investigation context. The investigation sub-agent keeps a separate procedural memory store organized by data-source tags such as aws, okta, osquery, and workshop, holding schema findings written by a lighter model. Tines database records hold stateful objects such as open agent-created pull requests and Panther investigation state.[Source 1]
- Context management
- The triage agent receives the full Slack thread history plus its steering-memory markdown document, loaded into context at the start of every run. It has no ambient access to whole Slack channels, and outside direct messages it can read a thread only when it is re-tagged on the latest message.[Source 1]
- Credentials
- Authorization controls limit the agents to security team members, and Figma states that the agent works on behalf of an authorized team member and that its tools are scoped, authorized, and monitored. Pull requests the agent opens are authored by a service account, so the PR description carries the requesting engineer's name and a link to the originating Slack thread. The post does not document how the agent authenticates to each connected system.[Source 1]Authorization scoping, the service-account pull-request identity, and the on-behalf-of rule are stated; the authentication mechanism for each connected system is not.
- Interfaces
Alert summaries also reach Asana tickets and investigation context is indexed from them, but Asana is not an interface value in the schema.
- slack
- github
- webhook
Mechanisms
Panther alert → retrieval summary and precedent → intent routing → scoped-tool investigation → draft pull request[Source 1]
Case memory holds past alerts and investigation context, steering memory holds behavioral rules the agent can update when an engineer corrects it, Tines database records hold stateful objects, and the sub-agent's tagged procedural memory holds schema findings it saves after a discovery query[Source 1]
Validation and failure handling
Every pull request the agent creates is set to draft by a deterministic post-step in the Tines workflow rather than by a prompt instruction, and the same tool-calling contract keeps sensitive employee information out of Okta responses and stops the agent closing or modifying pull requests it did not author[Source 1]
Reported observations
These results come from the sources. Notes below each result explain what it covers and any reported limits.
Around 70% reduction in time-to-resolution on complex alerts, reported by Figma in July 2026[Source 1]
- Reported by
- Figma
- Scope
- Time-to-resolution on complex security alerts handled by the agent system
The source does not report the denominator of this figure.
Observed in July 2026
About this result
- Category
- Cost latency
- Evidence type
- Estimate
- What it covers
- Time-to-resolution on complex security alerts handled by the agent system
Figma reports a 20% drop in on-call pages from automatically downgrading the severity of alerts the retrieval layer scored as high-confidence benign or duplicate[Source 1]
- Reported by
- Figma
- Scope
- On-call pages, after automatically downgrading high or critical alerts scored as high-confidence benign or duplicate
The source does not report the denominator of this figure.
Observed in July 2026
About this result
- Category
- Cost latency
- Evidence type
- Reported measurement
- What it covers
- On-call pages after automatic severity downgrading of high-confidence benign or duplicate alerts
Figma reports 25% fewer endpoint software approval requests, which it attributes to the agent detecting when a user is asking about a tool and directing them to comparable approved alternatives[Source 1]
- Reported by
- Figma
- Scope
- Endpoint software approval requests reaching the security team
The source does not report the denominator of this figure.
Observed in July 2026
About this result
- Category
- Cost latency
- Evidence type
- Reported measurement
- What it covers
- Endpoint software approval requests reaching the security team
Figma reports meaningfully higher on-call engineer confidence in resolution quality, which it attributes to the agent's evidence chain being explicit and reviewable; no measurement is given[Source 1]
- Reported by
- Figma
- Scope
- On-call engineer confidence in resolution quality
Observed in July 2026
About this result
- Category
- Effectiveness
- Evidence type
- Qualitative
- What it covers
- On-call engineer confidence in resolution quality
Figma reports that the first question the investigation sub-agent was asked about Zoom activity needed multiple schema-discovery queries, and that the same question cost a single query after the sub-agent saved a procedural memory[Source 1]
- Reported by
- Figma
- Scope
- Queries the investigation sub-agent needed for one repeated data-lake question, before and after it saved a schema memory
Observed in July 2026
About this result
- Category
- Cost latency
- Evidence type
- Qualitative
- What it covers
- Queries the investigation sub-agent needed for one repeated data-lake question before and after saving a schema memory
Figma states the system handles all initial security response work for the security team, and that the on-call engineer's job shifted from investigating from scratch to reviewing what the agent found[Source 1]
- Reported by
- Figma
- Scope
- Initial security response work for Figma's security team
Observed in July 2026
About this result
- Category
- Adoption output
- Evidence type
- Qualitative
- What it covers
- Share of initial security response work the system handles for Figma's security team
Lessons
Figma separates precedent from policy across memory layers, after saving everything as steering memory started overriding the agent's behavior in unwanted ways; a one-off lesson about a specific alert type goes into retrieval investigation context, and a behavioral rule that should change how the agent approaches all alerts goes into steering memory.[Source 1]
Reported opinion: Figma's security team says procedural memory should have been in the system from the start, because the investigation sub-agent's self-built schema memory was a late addition whose improvement was dramatic enough that the earlier work feels wasted in retrospect.[Source 1]
Figma manages its core agent tool set in configuration-as-code outside any individual agent, after team members iterating quickly produced divergent copies of the same core agent with different tool configurations.[Source 1]
Figma enforces controls as deterministic post-steps in the Tines workflow rather than as prompt instructions, after finding that relying on the model to remember an instruction such as always creating a pull request as a draft was not reliable enough.[Source 1]
Figma includes the requesting security engineer's name and a link to the originating Slack thread in every agent-authored pull request, because bot-authored pull requests make git blame point at a service account; the team says it should have done this from the start.[Source 1]
Reported opinion: Figma's security team says it is more comfortable with agent autonomy when the action is bounded, reversible, and supported by clear evidence than when it is broad, destructive, or hard to audit, and that read-heavy investigation, duplicate detection, precedent retrieval, and draft remediation fit agentic execution better than generic high-powered write paths.[Source 1]
Reported opinion: Figma's security team advises designing the Slack trust model for public channels up front rather than bolting it on, because user-activity detail that is fine in a private security thread becomes a problem in a channel with a hundred people; Figma handles this with channel-aware prompt design and other deterministic controls.[Source 1]