Forensiq - Intelligent Security Operations & Investigation Platform

DOI

https://www.doi.org/10.59256/ijire.20260706006

Published In

Volume 7, Issue 6 (2026)

Published Online

November-December 2026

Pages

53-60

Article Type

Original Article

Check for updates

Security Operations Centers process security alerts from many different systems. Analysts must match events gather evidence add data and evaluate risk before deciding. Forensiq is a platform that uses AI agents to help with these tasks. It works inside Splunk. Handles alert ingestion, event exploration, alert triage, threat-intelligence enrichment of indicators of compromise, mapping to MITRE ATT&CK correlating events calculating risk reasoning through investigations checking claims with facts and producing reports for analysts. A multi-agent design splits the work into tasks but the original data stays for analysts to check. Tests will look at how alerts are sorted how well ATT&CK mapping works how much threat data is added, how well evidence supports claims how many unsupported claims appear, how good event correlation is, how efficient investigations become, how good reports are and how the system scales. The final test will compare the Forensiq workflow to a baseline under the same data. Forensiq is meant to help analysts; the system gives reasoning support. Does not replace human checking and response decisions.