Commvault e Microsoft: A ascensão dos agentes de IA nas operações de recuperação de desastres

Pontos principais

Security must scale like Agent Smith: In The Matrix, Agent Smith multiplied rapidly to overwhelm Neo. Security teams face a similar challenge today as threats and signals grow faster than analyst capacity. AI-enabled security agents help teams scale investigations without needing to scale headcount.
Correlating signals improves investigation confidence: The Commvault Security Investigation Agent correlates backup intelligence with security signals from platforms like Netskope, CrowdStrike, and Palo Alto Networks to determine whether threats discovered in backup data also impacted production systems.
Cyber resilience will become agent-driven: The Commvault Security Investigation Agent is the first step toward a future where specialized AI agents assist security teams with investigations, recovery decisions, and faster restore workflows.

Introdução

In The Matrix, there’s a moment that feels surprisingly relevant to today’s technology landscape. Agent Smith discovers he can duplicate himself. One becomes many, and suddenly Neo is surrounded by an army of identical agents operating simultaneously.

In many ways, that scene mirrors the world we’re entering today with agentic AI. Across industries, and especially in cybersecurity, we’re beginning to see the rise of specialized AI agents that can work independently, scale rapidly, and assist humans in ways that were previously impossible. But unlike Agent Smith’s relentless takeover, the goal of these agents isn’t domination. It’s defense.

Expandir a escala e, ao mesmo tempo, eliminar silos

Security operations today face a fundamental scaling problem. The number of systems, signals, and security tools continues to grow, but the number of analysts does not.

Organizations now ingest telemetry from endpoint security platforms, network defenses, cloud monitoring tools, and identity protection systems. Each of these tools generates its own alerts and dashboards, often operating in isolation from one another. The result is an overwhelming amount of data spread across disconnected silos.

It’s tempting to assume the solution is simply hiring more analysts, but anyone who has managed large teams knows that adding people introduces its own challenges. As teams grow, communication becomes more complex, coordination slows down, and the efficiency of investigations often decreases.

What security teams really need is not just more people, but more intelligence and automation to help analysts move faster and see the bigger picture.

One of the most persistent silos in security operations has been the divide between backup systems and security tools. Traditionally, security teams monitor production environments through their security information and event management tools while backup environments operate in a separate console.

Backup data is often only examined after an incident occurs, when organizations are already deep in recovery mode. Yet attackers increasingly target backup systems precisely because they know they are critical to recovery.

Ransomware operators frequently encrypt production systems, attempt to corrupt backups, or leave malicious artifacts hidden inside protected datasets. This means that backup environments often contain valuable evidence of an attack, but that intelligence has historically been difficult for security teams to access and correlate with other signals.

O novo agente de investigação de segurança

Commvault’s new integration with Microsoft Sentinel and Microsoft Security Copilotfoi projetada para preencher essa lacuna. Por meio dessa integração, Cloud do Commvault Cloud podem ser transmitidos diretamente para o Sentinel Data Lake, reunindo os dados de telemetria de backup no mesmo ambiente analítico que os sinais cloud de terminais, redes e cloud.

Em vez de ocorrer de forma isolada, a atividade de backup agora pode ser analisada em conjunto com o ecossistema de segurança mais amplo. Mas o verdadeiro potencial dessa integração reside na introdução do Commvault Security Investigation Agent.

O Agente de Investigação de Segurança auxilia os analistas a investigar possíveis ameaças, correlacionando sinais detectados em ambientes de backup com sinais provenientes de outras plataformas de segurança. Quando um analista fornece o nome do host de um servidor, o agente coleta eventos de segurança gerados pelo Commvault Threat Scan Risk Analysis, incluindo anomalias no backup, eventos de criptografia que possam indicar atividade de ransomware, malware detectado em conjuntos de dados protegidos e backups que contenham dados confidenciais.

Em seguida, o agente correlaciona esses eventos com os dados de telemetria de outras ferramentas de segurança nas quais as organizações já confiam, como Netskope, CrowdStrike e Palo Alto Networks. Ao analisar conjuntamente a atividade nessas plataformas, o agente pode ajudar a determinar se o comportamento suspeito identificado nos dados de backup também aparece nos ambientes de produção.

Como conseguir o agente?

Let’s first walk you through how you can start with our first agent focused on security investigations. Then we’ll share how we plan to rapidly spawn new agents – just like Agent Smith – so customers can take control of investigations, recovery decisions, and restore operations, giving security and operations teams the intelligence they need to respond faster and recover with confidence.

Configurar o conector

Antes de ativarmos o Commvault Security Investigation Agent, você precisará instalar e configurar o Commvault Cloud .

Installation: Instructions for how to install the Commvault Cloud Solution, along with permissions and pre-requisites, isaqui.

Screenshot: Installation details for the Commvault Cloud Data Connector in the Microsoft Sentinel Content Hub.

Configuration: Once installed, configuration details areaqui.

Use Commvault Security Investigation Agent

Assim que o Cloud Commvault Cloud for instalado, você poderá usar o novo Agente de Investigação de Segurança.

Acessehttps://securitycopilot.microsoft.com/agents.
Search for “Commvault Security Investigation Agent.”
Click on “Set up” Agent.
Click on “AcesseAgent.”
Click on “Run” => “One time.”
Provide the “Hostname” for the host you’d like help investigating, and click “Submit.”
1. Note: Hostname is the name of the server that we want to check for events of Commvault and partners like Netskope, CrowdStrike and Palo Alto.
O agente será executado e, como resultado, você receberá uma análise detalhada e recomendações.

Screenshot: The detailed analysis of the Commvault Security Investigation Agent being run on a host that is part of an investigation.

Conclusão

The Matrix may have dramatized the idea of multiplying agents, but it captured an important truth about scale. When Agent Smith multiplied, the dynamics of the fight changed entirely.

Cybersecurity is undergoing a similar shift. Attackers are increasingly leveraging automation and AI to scale their operations. The only way defenders can keep pace is by scaling their own capabilities through intelligent systems that augment human expertise.

With the integration between Commvault, Microsoft Sentinel, and Microsoft Security Copilot – and with the introduction of the Commvault Security Investigation Agent – we are beginning to see what that future looks like. It’s a world where security operations are no longer constrained by silos, where investigations move faster, and where AI-enabled agents work alongside analysts to strengthen cyber resilience across the entire environment.

Over the coming year, Commvault plans to introduce additional agents – just like Agent Smith multiplying in The Matrix – that can help security teams run Commvault Threat Scan, spin up Cleanroom environments for SOC analysts to safely investigate incidents, and accelerate recovery by identifying the safest data to restore.

We’re also excited to collaborate with Microsoft to enable customers to use Microsoft Foundry to build and extend their own agents, allowing them to tailor automation and investigations to their unique environments.

By combining Commvault’s deep cyber resilience capabilities with Microsoft’s AI and security ecosystem, we’re helping organizations move toward a future where intelligent agents help analysts investigate faster, break down silos, and strengthen resilience across the entire environment.

Perguntas frequentes

Q: What are AI agents in security operations (SecOps/ResOps)?
A: AI agents are specialized, autonomous tools that assist security teams by analyzing data, correlating signals, and supporting investigations. They operate alongside human analysts to help accelerate decision-making and improve response times across complex environments.

Q: Why is scaling security operations such a challenge today?
A: Security teams face an explosion of alerts and data from multiple tools, while analyst headcount grows slowly. This imbalance creates bottlenecks, making it difficult to investigate threats efficiently without automation and intelligent assistance.

Q: How does the Commvault Security Investigation Agent improve threat investigations?
A: The agent correlates backup data with signals from security platforms like CrowdStrike, Netskope, and Palo Alto Networks. This combined view helps enable analysts to determine whether threats detected in backups also impacted production systems, increasing confidence in investigations.

Q: What problem does integrating backup data into security workflows solve?
A: Backup environments often contain critical evidence of attacks but have historically been siloed from security tools. Integrating this data helps enable teams to analyze threats holistically, uncover hidden risks, and make more informed recovery decisions.

Q: How can organizations start using the Commvault Security Investigation Agent?
A: Organizations need to install and configure the Commvault Cloud connector within Microsoft Sentinel. Once set up, the agent can be accessed through Microsoft Security Copilot to run investigations by simply providing a hostname.

Q: What does the future of AI agents in cyber resilience look like?
A: The future points toward multiple specialized agents helping handle investigations, recovery planning, and restore operations. These agents will help break down silos, accelerate response, and enable more resilient security operations across the entire environment.Ritu Singh é gerente sênior de produtos e Rich Vorwaller is Director, Product Management, at Commvault.