Security operations agents

Harvey’s SOC combines independently scheduled reporting, alert-triage and threat-watch agents for its security team.

Company: Harvey
Approach type: Agent family
Work: Security
Human involvement: Drafts reviewed
Invocation: Scheduled, Interactive
Deployment stage: Deployed
Evidence strength: Detailed primary
Entry reviewed: 2026-09-17

Copy as MD Ask ChatGPT

How it works

detection engineering and tuning → human-reviewed production-change PRs.

Review telemetry

Daily reporting and hourly triage agents inspect telemetry and escalate critical clusters.^{[Source 1]}

Investigate threats

Threat-watch compares external intelligence with coverage and proposes detections.^{[Source 1]}

Where people stay involved

People review, approve, or guide the agent’s work here.

Supervision level
Work-product review
A person reviews the draft or implementation.
Level 3 of 5
- detection engineering and tuning → human-reviewed production-change PRs^{[Source 1]}

How supervision levels work

Implementation details

Model: Not reported
Harness: Separate security infrastructure from Spectre.^{[Source 1]}
Sandbox: Not reported
Tool access: RunReveal MCP exposes security corpus tools.^{[Source 1]}
Knowledge: ClickHouse security telemetry and threat-model instructions.^{[Source 1]}
Context management: Postgres memory with retention, deduplication and profile-specific injection budgets.^{[Source 1]}
Credentials: Not reported
Interfaces: Not reported

Validation and failure handling

Review production changes

Data-tested detections and tuning rules become GitHub pull requests for human review.^{[Source 1]}

Reported observations

Not reported

Lessons

Not reported: The available sources do not report lessons from this work.

Back to agents

Improve this record

Give your coding agent the context and instructions to prepare a source-backed update.

Suggest on GitHub

Paste the prompt into your coding agent, then describe the correction or add a public source.

Preview prompt

Help me update the Internal Agents Map record for Security operations agents at Harvey.

Repository: https://github.com/steel-experiments/internal-agents-map
Record: data/agents/harvey-security-operations.yaml
Published record: https://internal-agents.com/agents/harvey-security-operations
Readable context: https://internal-agents.com/agents/harvey-security-operations.md

Use the correction or public source I provide in this conversation. If I have not supplied either, ask what I want changed before editing.

Use an existing checkout of this repository, or clone it if needed. Read the current record from the repository. Follow AGENTS.md, CONTRIBUTING.md, and the relevant instructions in data/schema.md.

Verify that the evidence supports the requested change. Preserve uncertainty and distinguish reported facts from catalog judgments. Follow the repository process for capturing new sources. If evidence is insufficient, explain the gap instead of inventing details.

Make a focused change on a branch. Regenerate derived files and run the required checks. Do not edit generated content by hand.

Show me the change, supporting evidence, and check results, including any checks you could not run. Ask whether to submit a pull request unless I already requested one. Do not merge the pull request. If you cannot edit the repository, prepare a source-backed issue draft.

Sources and research details

Citations link to the original publisher. Each source also keeps a preserved copy in the repository, so a changed or removed page stays checkable.

Building an agentic security operations centerhttps://www.harvey.ai/blog/building-an-agentic-security-operations-centerEngineering blog · First party · Last source verification: 2026-08-31
Preserved copy

Question coverage and scope

purpose: Reported
workflow: Reported: Documented use example; no universal platform run is implied.
human involvement: Reported
implementation: Reported
validation: Reported
observations: Not reported
lessons: Not reported

Research details for every claim on this page

Summary
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsBuilding an agentic security operations centerEyes Always On; From Threat to Detection; Persistent Memory; Two Systems
Harness
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsBuilding an agentic security operations centerEyes Always On; From Threat to Detection; Persistent Memory; Two Systems
Knowledge
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsBuilding an agentic security operations centerEyes Always On; From Threat to Detection; Persistent Memory; Two Systems
Context management
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsBuilding an agentic security operations centerEyes Always On; From Threat to Detection; Persistent Memory; Two Systems
Tool access
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsBuilding an agentic security operations centerEyes Always On; From Threat to Detection; Persistent Memory; Two Systems
Review telemetry
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsBuilding an agentic security operations centerEyes Always On; From Threat to Detection; Persistent Memory; Two Systems
Investigate threats
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsBuilding an agentic security operations centerEyes Always On; From Threat to Detection; Persistent Memory; Two Systems
Review production changes
Statement type
Fact
Provenance
Reported
Confidence
Not assessed
Confidence reason
No explicit confidence assessment is recorded for this claim.
- SupportsBuilding an agentic security operations centerEyes Always On; From Threat to Detection; Persistent Memory; Two Systems
Operating model assessment
Statement type
Inference
Provenance
Catalog judgment
Confidence
Medium
Confidence reason
Harvey explicitly gates every production change through human review, while reports and triage have separate scheduled scopes.
Observation date
2026-05-14
- SupportsBuilding an agentic security operations centerFrom Threat to Detection to Tuned Alert: both detection proposals and tuning rules are GitHub PRs for human review