In this guest post, Eric Newcomer, Principal Analyst at Intellyx, explains why data is essential for building and running effective AI workflows.
In the current phase of AI transformation, everyone is discovering many applications for gen AI, especially chats with LLM trained data, public as well as private.
One interesting application of AI is building modern workflows to automate operational processes.
Public data, such as the data gen AI bots are trained on, helps identify the potential steps in such a workflow, and helps prepare the organization by creating plans, training materials, and documentation.
Training LLMs on private data, such as monitoring logs and event data, helps execute workflow steps more efficiently and effectively, which helps an organization reduce employee cognitive load and more quickly deliver a significant business benefit.
Identifying flow steps
A good starting point is to ask a gen AI bot to identify the steps you should include to implement a specific operational workflow, such as responding to a security incident.
For example, you could use the following prompt:
“What process steps should I consider when creating a workflow to respond to a cybersecurity incident?”
ChatGPT responded to this prompt with a list of nine steps, from preparation through continuous improvement, as shown in the figure below.
If you don’t yet have a formal process for responding to a security incident, or for responding to events, obtaining a generic process recommendation from a gen AI bot is a good way to start.
Leveraging data
Gen AI can help search public data to provide examples of an incident response plan, examples of a training program (or the definition of a training program), and retrieving lists of applicable technology solutions, as needed for the first and last steps in the example.
The second step in the flow – detection and identification – is one in which the results depend entirely on the quality of available private data.
This is where gen AI can have the most impact in reducing manual effort and speeding time to incident remediation.
When trained on the right data, gen AI automatically triages events from an incident monitoring tool and identifies the type and severity of the incident.
Depending on the type of incident, an AI agent can even automatically execute the next step in the flow, or determine which execution, response, or other action is required.
Reducing incident remediation time is always important, but is especially important for issues that impact customers. The sooner the incident can be identified and remediated, the better for the operation of the business.
From the “AI first” point of view, the most important thing to do is identify and ensure the quality of the private data an LLM uses for training.
Sources of private data for training the LLM includes incoming event streams, files, and data from multiple internal sources. To assist in this process, AI formats the data, summarizes information, and transforms the data into a common model.
The better the input data, the better the results are, and the better the results are, the faster incidents are resolved.
Gen AI can also help improve the data, creating transformation scripts and identifying anomalies.
Example of an AI powered workflow
Tines Workbench is an example of an AI powered tool that lets you create a “story” (or workflow) to automate an operational process.
For the security incident response example, let’s assume an alert is generated by Elastic Security (Elastic and TInes recently announced a partnership).
Elastic Security links to Tines Workbench using a Tines story, which creates a Webhook to initiate a response workflow when Elastic Security detects an alert.
The first step in the example flow uses gen AI to analyze the alert and gather additional information about the vulnerability causing the alert. Tines connects with most popular security analysis tools, such as GreyNoise for this purpose.
The augmented incident information is then submitted to a Slack channel to send a message about the incident to the group responsible for handling the incident. Another step in the workflow opens a Tines Case to record the incident.
The next step could use an AI agent to automatically send and receive commands to and from the Slack channel to get more information about the root cause, and invoke remediation actions, such as deleting malware or applying patches.
(Steps in a Tines Workbench flow can be configured to instruct an AI agent to take action, or to raise suggested actions to the group chat for approval.)
Once an incident is resolved, additional steps can invoke other actions to restore systems (if needed), archive chat messages, and test and monitor the remediations.
Steps then issue communications about the incident and its resolution to internal and external channels (if necessary).
Intellyx take
In the current age of AI transformation, AI impacts application development and execution. AI can create applications more quickly, and applications can invoke AI functions to improve results.
As in the Tines Workbench example, AI agents can take on some of the responsibilities of humans.
It can be challenging to get this right due to AI hallucinations and inaccuracies, but there are ways to reduce these problems.
One of the biggest ways is to break the problem up – such as focusing on individual steps in a workflow, as Tines Workbench does – and reduce the scope of an AI agent to a particular problem domain.
Getting it right, though, takes a lot of cognitive load out of analyzing and remediating security incidents, helping a business maintain customer trust.
To harness AI effectively however, the approach to designing and creating a workflow has to change: the capabilities of AI that help you become more productive are entirely dependent upon the quality of available data. That’s why Tines Workbench, for example, supports integrations with so many sources of data.
The quality (and quantity) of available data is definitely the key to building an effective modern workflow, as in the case of the Tines Workbench.
Copyright © Intellyx B.V. Intellyx is editorially responsible for this document. At the time of writing, Tines is an Intellyx customer. No AI bots were used to write this content. Image by Photo by Google DeepMind from Pexels.com.