AI + DFIR Primer: Agents and Scalability
Brief
AI agents are one of the ways to extend an LLM to answer your DFIR prompts. They’re a lot like MCP tools and skills and you can achieve the same goal (investigating phishing, for example) with any of the three. It’s an architectural decision with pros and cons either way.
“Agent” is also an extremely overused word right now, so the topic gets confusing fast. I hope to simplify it for you in this post.
As you experiment, remember to submit your wins and failures to our “ AI+DFIR: Good and Ugly ” challenge.
Basic Definition
“Agent” is hard to define because the term gets used so loosely. The most simple definition is that an AI agent is what runs in an Agentic AI framework.
LLMs call them, pass in arguments, and get a result. They are the microservices equivalent to GenAI architecture.
An agent can be as simple as Python code that adds two numbers that were passed in as arguments.