网络安全
Swilane 新增自定义AI 威胁检测和 Two-Way MCP 对涡轮的支持
在 Google 上的首选来源中添加 Unite.AI
AI安全分析师可以快速调查警报，但不能调查从未产生的警告。 Swiberane正以Turbine平台中新的客户定义检测能力瞄准这一缺口，使安全小组能够将自己的逻辑应用于操作数据，并将由此产生的警报直接发送到Swiberane AI SOC.
10月28日发布时还发布了推出双向模式上下文协议(MCP)支持和英雄AI应用程序构建器Agent. 增加部分将公司的自动化平台扩展到三个相关工作：决定哪些活动值得调查，将agents与工具连接起来，以及建立支持安全工作流程的应用程序。
Swilane 称能力普遍具备。 公告将其定位为对现有安全基础设施的补充，包括安全信息和事件管理(SIEM)、终点检测和反应(EDR)以及云安全工具。
让安全小组控制什么是警报
许多AI SOC产品在发现可疑行为后，专注于分解，调查和反应。 如果各组织部署新的agents、copilots、本地型号以及MCP服务器的速度快于既定的检测产品，那么这一部门就更加困难。
公司可能需要调查提交给未经授权的AI服务的敏感信息、意外使用当地模型、残废的护栏或agent消耗的资源远远超过其预期预算。 其中一些条件是本组织的政策和环境所特有的，而不是供应商可以事先界定的普遍签字。
新的Turbine能力让各小组根据平台可用的数据运行自己的检测逻辑。 Swillane 称一个单一的大数据动作可以评价数以万计的记录横跨平行计算节点，然后向AI SOC传递一个警报以进行调查，并管理响应。
这种架构带来检测逻辑更接近于自动操作的结果一个小组不能单独确定一个条件并手动汇总下一步，而是可以将其具体组织的规则与现有的调查工作流程联系起来。 任何探测的效用仍然取决于相关活性是否体现在图尔宾可以访问的数据中。
安全行业在过去两年里一直在争论AI如何能独立运作
该版还描述了AI辅助检测作者。 团队可以解释他们想要的检测，并利用图尔宾的游戏本生成能力来帮助建设。 产生这种逻辑并确定它可靠地确定预期行为仍然是不同的任务：针对具体组织的规则需要反映其运行环境的数据、权限和条件。
作为潜在事件源的AI系统调查
Swimlane将这些情景描述为AI检测和反应，或AIDR:AI系统本身成为事件的主题。 这不同于简单地使用人工智能模型来总结传统的钓鱼或终点警报。
提示词注入说明了这种区别。 agent可能会遇到嵌入在它正在处理的内容中的指令，从而造成外部材料影响其行为的风险。 一项有益的调查可能需要审查agent的投入、工具活动和由此产生的行动，而不只是寻找熟悉的恶意软件指标。
同样，意外支出激增可能表明agent发生故障或方向错误，而不像传统入侵那样。 客户定义的逻辑给各小组提供了一种表达自身部署异常因素的方法，前提是有必要的使用和行动信号。
宣布处理尺度是公司规格，而不是公布的基准测试，用于检测提示词注入或未经授权的AI使用的每一种形式。 实际变化是，各小组获得另一种途径，将自己的观察变成可采取行动的案件，同时由既定的安全产品提供警报。
MCP 在两个方向连接 Agents 和自动化
MCP提供了一个共同的界面，AI应用程序可以通过它使用工具。 Swilane的10月版支持了这种联系的两面。
作为MCP主机，Turbine允许Hero AI连接第三方的MCP服务器，并在调查和播放本时使用其工具，并有集中的认证和访问控制。 因此，一个安全工作流程可以称为外部的MCP兼容能力，并与其已经使用的API集成。
作为MCP服务器，Turbine向外部AI客户端暴露了受管自动化。 公告名称为Claude,ChatGPT,Cursor,Gemini CLI和Microsoft Copilot，作为客户端在现有的基于角色访问控制范围内可以引用图尔宾组件，包括多步播放本的例子。
区别是必然的。 在第一个方向，Swillane的agent伸向另一个系统。 在第二种情况下，外部助理可以启动经批准的Turbine工作流程。 将一个助手连接到一个既定的游戏本上，可以让企业重新使用其现有的自动化和权限，而不是在每个AI客户端内部重新创建操作程序。
游泳车称 Turbine可以将MCP工具与常规API结合。 这使得发布与只有部分系统支持MCP的环境相关：团队可以将协议纳入更广泛的工作流程，而不需要所有现有的整合同时改变。
利用人文评论建设安全应用
Hero AI应用程序构建器Agent解决了另一个工作来源：配置新安全使用案例所需要的记录结构，布局和工作流程。 用户用自然语言描述自己需要的东西，agent创建或修改了相应的应用程序。
根据该版本，产生的变化在某人审查之前仍未得到保存。 变革得到强调，用户可以接受或拒绝这些变革，然后才能持续下去。 这一批准点很重要，因为一个申请结构会影响分析人员如何收集证据、在各阶段之间转移案件和执行答复。
新的agent基于更广泛的英雄AI组合。 Swilane的产品材料描述了现有的agents用于数据摄入，游戏本生成，可视化和调查，以及个人agents选择模型的能力。 应用大楼将这种协助扩大到围绕这些任务开展的工作空间。
将AI 理性与可预测的自动化相结合
加入内容为Swillane AI SOC的路线模式，该模式指导确定自动化、AI协助调查和根据所需推理充分代理调查的工作。 现有的游戏本可以处理熟悉的步骤，而更复杂的案件可以借鉴代理调查和人文审查。
这是产品设计的一个重要部分：一个工作流程不必通过模型发送每一项任务。 已知的反应序列仍可保持常规自动化，而agent则有助于解释不熟悉的证据或构建调查计划。
客户定义的检测新增更早决定该操作模式：首先应该怎样触发程序？. 对于在整个组织中采用AI的安全小组，10月的发布提供了一种将自身对可接受行为的了解与在活动超出其范围时进行调查和反应的工具联系起来的方法。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cybersecurity
Swimlane Adds Custom AI Threat Detections and Two-Way MCP Support to Turbine
Add Unite.AI to your preferred sources on Google
An AI security analyst can investigate an alert quickly, but it cannot investigate a warning that was never generated. Swimlane is targeting that gap with new customer-defined detection capabilities in its Turbine platform, allowing security teams to apply their own logic to operational data and send the resulting alerts directly into Swimlane AI SOC.
The October 28 release also introduces two-way Model Context Protocol (MCP) support and a Hero AI Application Builder Agent. Together, the additions extend the company’s automation platform across three connected jobs: deciding which activity deserves investigation, connecting agents with tools, and building the applications that support a security workflow.
Swimlane says the capabilities are generally available. The announcement positions them as additions to existing security infrastructure, including security information and event management (SIEM), endpoint detection and response (EDR), and cloud security tools.
Giving Security Teams Control Over What Becomes an Alert
Many AI SOC products concentrate on triage, investigation and response after a detection system has identified suspicious behavior. That division becomes more difficult when organizations deploy new agents, copilots, local models and MCP servers faster than established detection products can accommodate them.
A company may need to investigate sensitive information submitted to an unauthorized AI service, unexpected use of a local model, a disabled guardrail or an agent consuming resources far beyond its intended budget. Some of those conditions are specific to the organization’s policies and environment, rather than a universal signature a vendor can define in advance.
The new Turbine capabilities let teams run their own detection logic against data available to the platform. Swimlane says a single big data action can evaluate tens of thousands of records across parallel compute nodes, then route an alert into AI SOC for investigation and governed response.
That architecture brings detection logic closer to the automation that acts on its results. Instead of separately identifying a condition and manually assembling the next steps, a team can connect its organization-specific rule to an existing investigation workflow. The usefulness of any detection still depends on whether the relevant activity is represented in the data Turbine can access.
“The security industry has spent the last two years debating how autonomously AI can work an alert, but that skips a more basic question: where did the alert come from?” said Cody Cornell, Swimlane’s co-founder and CEO.
The release also describes AI-assisted detection authoring. Teams can explain the detection they want and use Turbine’s playbook generation capabilities to help build it. Generating that logic and establishing that it reliably identifies the intended behavior remain separate tasks: organization-specific rules need to reflect the data, permissions and conditions of the environment where they run.
Investigating AI Systems as Potential Incident Sources
Swimlane describes these scenarios as AI detection and response, or AIDR: the AI system itself becomes the subject of the incident. That differs from simply using an AI model to summarize a conventional phishing or endpoint alert.
Prompt injection illustrates the distinction. An agent may encounter instructions embedded in content it is processing, creating a risk that outside material influences its behavior. A useful investigation may need to examine the agent’s inputs, tool activity and resulting actions, rather than look only for a familiar malware indicator.
Similarly, an unexpected spending surge could signal a malfunctioning or misdirected agent without resembling a traditional intrusion. Customer-defined logic gives teams a way to express what is abnormal for their own deployment, provided the necessary usage and operational signals are available.
The announced processing scale is a company specification, not a published benchmark for detecting every form of prompt injection or unauthorized AI use. The practical change is that teams gain another route for turning their own observations into actionable cases, alongside alerts supplied by established security products.
MCP Connects Agents and Automation in Both Directions
MCP provides a common interface through which AI applications can use tools. Swimlane’s October release supports both sides of that connection.
As an MCP host, Turbine allows Hero AI to connect to third-party MCP servers and use their tools during investigations and playbooks, with centralized authentication and access controls. A security workflow can therefore call an external MCP-compatible capability alongside the API integrations it already uses.
As an MCP server, Turbine exposes governed automation to external AI clients. The announcement names Claude, ChatGPT, Cursor, Gemini CLI and Microsoft Copilot as examples of clients that can invoke Turbine components, including multi-step playbooks, within existing role-based access controls.
The distinction is consequential. In the first direction, Swimlane’s agent reaches out to another system. In the second, an external assistant can initiate an approved Turbine workflow. Connecting an assistant to an established playbook gives an enterprise a way to reuse its existing automation and permissions, rather than recreate the operational process inside each AI client.
Swimlane says Turbine can combine MCP tools with conventional APIs. That makes the release relevant to environments where only some systems support MCP: teams can incorporate the protocol into a broader workflow without requiring every existing integration to change at once.
Building Security Applications With Human Review
The Hero AI Application Builder Agent addresses another source of work: configuring the record structures, layouts and workflows that a new security use case requires. Users describe what they need in natural language, and the agent creates or modifies the corresponding application.
According to the release, generated changes remain unsaved until a person reviews them. Changes are highlighted, and users can accept or reject them before they persist. That approval point matters because an application structure can affect how analysts capture evidence, move cases between stages and carry out a response.
The new agent builds on the broader Hero AI portfolio. Swimlane’s product materials describe existing agents for data ingestion, playbook generation, visualizations and investigation, as well as the ability to select models for individual agents. Application building extends that assistance to the operational workspace around those tasks.
Combining AI Reasoning With Predictable Automation
The additions feed into Swimlane AI SOC’s routing model, which directs work among deterministic automation, AI-assisted investigation and fully agentic investigation according to the reasoning required. Existing playbooks can handle familiar steps, while more complex cases can draw on agentic investigation and human review.
This is an important part of the product’s design: a workflow does not have to send every task through a model. A known response sequence can remain a conventional automation, while an agent helps interpret unfamiliar evidence or construct an investigation plan.
Customer-defined detection adds an earlier decision to that operating model: what should trigger the process in the first place? For security teams adopting AI throughout their organization, the October release offers a way to connect their own knowledge of acceptable behavior with the tools that investigate and respond when activity falls outside it.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.