Automation Builder Agent

What's new in Splunk Enterprise Security version 8.5.2

Splunk Enterprise Security version 8.5.2 was released on May 22, 2026. It is a Controlled Availability release and includes the following new enhancements:

Triage Agent

• Analyzes findings, gathers relevant context, and suggests a disposition with supporting reasoning and next steps. It helps reduce repetitive alert triage, surface higher-priority investigations faster, and gives analysts a stronger starting point for response.

Automation Builder Agent

• Helps SOAR users build playbooks through natural-language guidance in the Visual Playbook Editor. It grounds recommendations in your configured apps, actions, assets, and data paths to reduce playbook complexity and speed up time to automation.

Detection Builder Agent [Alpha]

• Helps analysts create, tune, and troubleshoot ES detections using natural language directly in the detection editor. It can assist with SPL, detection fields, validation, and testing, so teams can build higher-quality detections with less
  manual authoring effort.

Guided Response Agent [Alpha]

• Helps analysts move from investigation to action by recommending relevant SOAR actions or playbooks and guiding execution from the AI Assistant. It reduces context switching and helps teams respond faster while keeping the analyst in control.