\cleardoublepage \part{Detect} \setbookpart{Detect}

Part V: Detect

The Detect Function finds and analyses possible attacks; here AI has its most immediate effect and the autonomy levels matter most.

Chapter 18 describes the AI-assisted security operations centre, its investigation agents and the conditions under which an agent may act (DE.CM, DE.AE). Chapter 19 applies AI to detection engineering as code, threat intelligence and deception (DE.CM, DE.AE).

What you will learn in this part:

• Where AI adds value and risk in the SOC, and how analysts stay in command
• How AI-drafted detections are tested and reviewed