Google · soc-agent

Google Triage and Investigation Agent

Embedded Google SecOps alert investigation assistant producing verdicts and reasoning.

First observed 2026-04-01 · Last verified 2026-08-27 ·FRESH · ASI-1.0 · ASI-TAXONOMY-1.1

Deterministic executive summary

EARLYUNKNOWNUNKNOWN

Google Triage and Investigation Agent has 1 confirmed capability assertion(s) and 0 confirmed control assertion(s). Evidence maturity is EARLY; autonomy is UNKNOWN; action authority is UNKNOWN. No qualifying independent validation is recorded.

What actually differs?

The documented boundary is UNKNOWN with UNKNOWN operation. This describes authority and initiation, not effectiveness. No qualifying independent validation is recorded.

buyer

Treat missing independent validation as NONE_FOUND, not proof of ineffectiveness.

competitive

Compare documented action authority, trigger model, lifecycle, and evidence breadth; do not compare vendor outcome claims as equivalent measurements.

confidence

EARLY under ASI-1.0; No qualifying independent validation is recorded.

governance

Control evidence covers 0 scoped control assertion(s); verify local policy configuration before enabling write actions.

operational

Plan operating procedures around UNKNOWN initiation and UNKNOWN action authority.

technical

Current evidence establishes 1 scoped capability assertion(s); undocumented capabilities remain UNKNOWN.

Derived under ASI-1.0; last verified 2026-08-27.

Lifecycle

PUBLIC_PREVIEW · 2026-04-01

Evidence EV-GOOGLE-TIN-TRIGGER

trial quotas

Agents

triage

TIN

Evaluates incoming alerts and produces a structured assessment.

Capabilities: Autonomous investigation· Controls: NONE_FOUND

Autonomy and control

Derived autonomy UNKNOWN

Trigger
EVENT_DRIVEN · HIGH · FRESH
Persistence
UNKNOWN · LOW · UNKNOWN
Permission scope
UNKNOWN · LOW · UNKNOWN
Human gate
UNKNOWN · LOW · UNKNOWN

Each facet is separately evidence-backed; the A-label is derived.

Architecture

Google TIN supports both automatic and manual investigation triggers.

AFFIRMED

Capabilities

Autonomous investigation

Google TIN executes an investigation plan and returns findings and reasoning for supported alerts.

AFFIRMED

Capability evidence

Vendor documentation
HIGH
Public demonstration
NONE_FOUND
Independent validation
NONE_FOUND
Production effectiveness
UNKNOWN

ASI-1.0: Rows represent evidence categories; assertion support confidence is intentionally not rendered beside the capability name.

Assertion support

HIGH under ASI-1.0:Recomputed at publication semantic_as_of with current freshness and unresolved-contradiction state.

Evidence and provenance

VENDOR DOCUMENTATION EV-GOOGLE-TIN-CAPABILITY · E1

It evaluates incoming alerts, executes an investigation plan, and provides a structured analysis that includes both its findings and reasoning.
Canonical source →

Evidence conflicts

No human-confirmed conflict is published for this system.

Recent changes

NO_MATERIAL_CHANGE is recorded for this profile.

Unknowns

Any evidence-panel row marked UNKNOWN is not a negative capability claim. Any NONE_FOUND row means the current governed corpus contains no qualifying evidence.

Sources

Compare claims with evidence categories