Figma Security Alert Triage
Suggested workflow: Implement tiered routing and investigation for security alerts, using analyst feedback to improve the system. Task: Figma implemented a tiered security alert triage system where a low-cost model routes alerts and a stronger model investigates them using Okta, Wiz, and Panther. Analysts review the findings and provide corrections, which the agent uses to update its own steering file for future improvements. All proposed fixes are submitted as draft pull requests requiring human approval before merging.; tools: Tool described in the source. Human role: Not stated in the source; limitations: This workflow relies on specific integrations with Okta, Wiz, and Panther, which may not be available in all environments. The system requires active analyst feedback to refine the steering file, implying ongoing human involvement. Source reliability is secondary, as the details are summarized from a blog post rather than primary technical documentation..
Tools
Tool described in the source
Published on Agent Work Atlas:
Overview
Suggested workflow: Implement tiered routing and investigation for security alerts, using analyst feedback to improve the system.
Workflow
Figma implemented a tiered security alert triage system where a low-cost model routes alerts and a stronger model investigates them using Okta, Wiz, and Panther. Analysts review the findings and provide corrections, which the agent uses to update its own steering file for future improvements. All proposed fixes are submitted as draft pull requests requiring human approval before merging.
Reported result
The implementation resulted in a 71% faster time to resolution and a 20% reduction in on-call pages. These metrics are attributed to the specific Figma case study cited in the source. No other performance data or failure rates are provided in the text.
Human role
Not stated in the source
Limitations
This workflow relies on specific integrations with Okta, Wiz, and Panther, which may not be available in all environments. The system requires active analyst feedback to refine the steering file, implying ongoing human involvement. Source reliability is secondary, as the details are summarized from a blog post rather than primary technical documentation.
Try it
I want to pilot a tiered security alert triage system similar to Figma's. Context: We have [replaceable: number] daily security alerts from [replaceable: SIEM/Tool names]. Goal: Reduce time-to-resolution by automating initial routing and investigation. Steps: 1. Set up a low-cost LLM to classify and route incoming alerts based on severity and type. 2. Configure a stronger LLM agent to investigate high-priority alerts by querying [replaceable: specific tools like Okta/Wiz/Panther] for context. 3. Implement a feedback loop where security analysts can correct the agent's findings, and the agent updates its steering instructions accordingly. 4. Ensure all remediation actions are drafted as PRs or tickets, never auto-executed. Deliverables: A configuration file for the routing logic, a prompt template for the investigation agent, and a dashboard showing alert volume, resolution time, and analyst correction rates. Safeguards: Start with a dry run on historical data. Require human approval for any changes to the steering file. Monitor for false positives and ensure no destructive actions are taken without explicit confirmation.
Source reports are not independently verified. Publication date is the catalog publication date, not the original article date.