A new ally against threats: Mavriq's SOC Triage Agent
Cluster Reply supported Mavriq in enhancing the triage of security incidents with the AI agent. Integrated with Microsoft Sentinel, the SOC Triage Agent automates initial incident analysis and supports analysts in their decision-making.
#SecurityOperationCenter
#Automation
#AIAgent
THE CHALLENGE
Speed up first-level security incident triage, cut through false-positive noise, while keeping analysts in control of every decision.
THE CONTEXT
Mavriq brings together Moltiply Group’s brands specialising in online product and service comparison and brokerage. Every month, millions of consumers rely on its platforms, including MutuiOnline.it, Segugio.it, Trovaprezzi.it and Switcho in Italy, and LeLynx.fr, Rastreator.com, Pricewise.nl and Verivox.de, internationally. For a digital-first organization where user trust is essential, securing infrastructure and data is a true competitive differentiator.
Mavriq’s Security Operations Center (SOC) monitors its environment using Microsoft Sentinel, which generates a continuous stream of incidents to analyse every day.
Initial analysis requires analysts to perform repetitive information gathering and verification tasks, taking time away from genuine threats, as some incidents ultimately turn out to be false positives or legitimate activity.
The company therefore decided to introduce an AI agent to automate the initial analysis of each incident, reduce false positives by refining the rules that generate them, and provide analysts with an assistant they can use to investigate further through natural language.
THE SOLUTION
SOC Triage Agent
Cluster Reply developed the SOC Triage Agent, an AI agent integrated with Microsoft Sentinel that works alongside the security team. Whenever a new incident is created, the agent starts working automatically: it gathers the associated alerts and entities, queries logs, compares the case with those previously handled by the team, and adds its analysis directly to the incident, including a classification, confidence level and supporting evidence. When it identifies a genuine threat, it reconstructs the attack sequence and recommends actions. On request, the agent identifies the noisiest detection rules and suggests specific changes to improve their accuracy. A dedicated web app completes the solution, giving analysts an overview of analysed incidents and a chat interface to investigate each case with the agent. The agent recommends; the analyst decides. The SOC remains in control at all times.
HOW WE DID IT
Intelligent triage, human oversight
The SOC Triage Agent was developed on Microsoft Azure using a serverless architecture, natively integrated with the Microsoft security ecosystem. Powered by Azure OpenAI GPT models hosted on Microsoft Foundry, the agent queries Sentinel and Defender XDR through MCP tools developed by Cluster Reply on Azure Functions. These tools allow it to read analytics rules and document incidents, supporting a faster, more structured and effective triage process.
Triage is orchestrated through Sentinel automation rules and Azure Logic Apps. Azure AI Search stores the history of closed incidents and analysts’ verdicts, while a feedback loop enables the agent to learn from the team’s decisions. The web app runs on Azure App Service and is secured by Microsoft Entra ID. The entire infrastructure is defined as code using Terraform, and services communicate through managed identities, with no credentials to store.
The RESULT
The first level of SOC analysis is automated, with analysts maintaining oversight
Mavriq is the corporate brand that brings together Moltiply Group’s brands operating in online product and service comparison and brokerage, and is one of Europe’s leading technology companies in the sector. With around 20 brands across six countries, including Segugio.it, Trovaprezzi.it, SOStariffe.it, MutuiOnline.it, Switcho, Verivox, Pricewise, Rastreator and LeLynx, it helps more than 25 million users every month compare energy and telecommunications plans, insurance, mortgages, loans and e-commerce products. Mavriq is a brand of Mavriq S.r.l., a subsidiary of Moltiply Group S.p.A., a company listed on Borsa Italiana’s STAR segment and the holding company of a group primarily operating in online financial product and service brokerage and the outsourcing of complex processes in the financial services sector