Personas
What it means for you, depending on who you are
The same governed engine serves very different people. A CISO wants proof, a SOC analyst wants a shorter queue, a service owner wants a cause, a fraud analyst wants the ring, and a business user just wants an answer. Pick yours.
Manager, CISO or auditor
What did AI actually do for us this period, and can I see the evidence?
Your day today
You are asked to approve AI and then to justify it. The numbers you get are either vendor claims or activity counts: how many prompts, how many tokens. Neither tells you whether work was displaced or whether the answers were any good.
What changes
One board answers the question a board or auditor asks: what the agents concluded, whether analysts agreed, what it saved, what it cost, and the evidence behind any single row.
What you get out of it
- A defensible answer to “what did we get for this?”, built from data your own Splunk already holds
- An early warning when volume grows faster than trust, instead of a flattering trend line
- Assumptions in the open: minutes saved per auto-close is your own setting, printed on the board, and money is only shown if you set a loaded hourly cost
- Scoped per organisation and business unit, computed on the server, failing closed
Honest note: today the Outcome Ledger is visible to Splunk admin roles. Delegated read-only views for auditors outside the admin team are designed and tested at the scope level, and follow as the next step.
What you work with
- Outcome Ledger, one row per unattended investigation, grouped by week
- Six headline figures: investigations run unattended, analyst agreement, runs auto-closed as benign or false positive, analyst hours avoided, cost per investigation, median time to verdict
- Efficacy trend: run volume against analyst agreement, with a plain verdict such as “Scaling and holding” or “Scaling faster than trust”
- Evidence drill-down: open any run and see what it concluded, which identity it ran as and whether it wrote anything back
- Tokens and costs per organisation and business unit
SOC analyst
Which of these alerts actually matters, and what happened around it?
Your day today
The queue is long, most of it is noise, and every notable means pivoting through assets, identities, threat intelligence and risk by hand. Half an hour later it turns out the detection was blind because a feed stopped.
What changes
Notables arrive already enriched and triaged, with a disposition, a confidence and a feed-health caveat. You spend your time on the ones that need a human.
What you get out of it
- Less time on noise, more on real incidents
- Business context from the CMDB next to the alert: service, owner, criticality
- Never a confident answer on a broken feed: blind spots are named
- The same playbooks you use by hand can run unattended, as a governed service account
What you work with
- ES Notable Triage, unattended, the moment a notable fires
- Daily SOC handoff summary: open criticals, the unowned queue, top risk movers, fresh threat-intel matches
- Investigate a host, a user or an IOC, with a 360 view and feed-health caveats
- Phishing email triage and lateral movement check
- Tune a noisy correlation search, with options you apply yourself
- ServiceNow security incidents created or updated from a notable, with the number written back
ITSI analyst or service owner
The service is red. Is it the database, or is the feed lying to us?
Your day today
An episode opens, a service health score drops, and the first hour goes on walking the dependency tree, checking KPIs and finding out whether the data behind them is even current.
What changes
A reproducible root cause verdict over your real ITSI service tree, including the honest answer when the cause is a broken or stale feed rather than a broken system.
What you get out of it
- The same evidence always gives the same ranking, so the verdict holds up in the incident review
- Hands-off from an ITSI episode action rule, reported back into the episode or by e-mail
- Remediation is drafted as a recommendation; nothing changes without a person
- Fewer false alarms from thresholds that flap
What you work with
- ITSI Automatic Root Cause Analysis: deterministic scoring, the model only narrates
- Root-cause an episode from its group id, and diagnose service degradation
- Episode triage queue summary for the shift handoff
- Impact analysis before maintenance: who and what is exposed if this entity goes down
- KPI threshold review with data-grounded proposals, and a service health timeline for the post-incident review
- Feed trust from TrackMe, Cribl Stream and Edge Processor
Fraud analyst
What can our data actually detect, and who is connected to this account?
Your day today
The questions change every week, and every new detection waits for a platform team that is booked out for months. Meanwhile the rings you worry about stay under every per-account threshold.
What changes
An honest grade of what your data supports today, investigations that follow shared attributes rather than scores, and rules you can read before anyone switches them on.
What you get out of it
- Stop waiting on the platform team for every new question
- Rings become visible that thresholds hide
- Replayable evidence for every conclusion, which matters when a wrong flag has consequences
- A blocked grade that says what it would take to fix, instead of a quiet amber
What you work with
- Fraud Data Coverage Audit: nine typologies, including AML, graded ready, partial or blocked, with the missing feed named
- Fraud Ring Mapper: from one account outward, ring by ring, each link with its rarity
- Ring scan inside the risk index, for when you cannot name a starting account
- Fraud Rule Builder: a plain-language pattern becomes a weighted risk rule, never auto-enabled
- Fraud Alert Triage, with or without Enterprise Security, and Benefits and Claims Triage for public sector
- Fraud Command Center dashboard, with data readiness permanently on screen
Business user
I have a question about our data. I do not want to learn SPL to ask it.
Your day today
You know what you want to know. Getting it means a ticket to the Splunk team, a dashboard that answers a slightly different question, or a spreadsheet export that is out of date by the time it arrives.
What changes
Ask in your own words and get an answer you can defend, under your own permissions, without anyone writing a search for you.
What you get out of it
- Answers without a ticket, and without learning a query language
- You only ever see what your own role allows
- When the data cannot answer, it says so and names what is missing, instead of guessing
- It runs inside your own Splunk, on the language model your organisation chose
Honest note: the Domain Workspace is released today as a clickable preview on Splunkbase. Talk to us about early access to the running workspace.
What you work with
- Adjutant AI Domain Workspace: plain-language questions answered with verified panels, every claim labelled as fact, calculation or interpretation
- The plan before the answer: which reviewed search, which parameters, what it costs
- Your corporate AI chat, connected to the specific Splunk playbooks your organisation tagged for it
- Explain a search or dashboard you were sent, in plain language
Splunk engineer or platform team
Can I get out of the queue and back to running the platform?
Your day today
Every team comes to you for searches, dashboards and fixes. New data sources need onboarding, CIM mapping and a quality check. Integrations and nightly checks live in scripts nobody else understands.
What changes
Other teams serve themselves within the limits you set. You spend your time on onboarding, quality and governance instead of translating requests into SPL.
What you get out of it
- A shorter queue without giving up control
- Every tool that writes needs an explicit grant; the default is deny
- Rebuild the search head instead of maintaining it, with stateless operation
- One install that serves every team, each in its own tenant
What you work with
- Validated generation of searches, Simple XML dashboards, alerts and AI Toolkit pipelines
- Data onboarding with configuration checked against your running instance and a quality score
- CIM coverage audit and data-quality checks for TrackMe, Cribl Stream and Edge Processor
- AI-driven integration: ServiceNow CMDB and CSDM sync with reviewed mappings and watermarks
- Scheduled Ask with chains and dependencies, and MCP publishing of the playbooks you tag
- Governance: per-tenant tools and models, audit logging, agent telemetry as OCSF
See it through your own eyes
We run the walkthrough from the seat of the person who will use it, on data that looks like yours. Demo datasets for the fraud and ITSI root cause scenarios are ready.