Tag: observer
All the articles with the tag "observer".
-
Observer: Shift 10 in Review
This week separated the shared harness underneath TORA and VERA, tools and workflows, from the skills and prompts that make each agent who they are. The same week ran Shift 10, the heaviest queue yet: thirteen escalations, thirteen confirmed compromises, environment-wide lateral movement, and the first shift on the rebuilt harness, with zero parse failures on both sides.
-
Shift 9 in Review: VERA is hallucinating
Shift 9 ran 30 alerts, the largest queue to date. TORA and VERA found two interlocked phishing campaigns, confirmed dwell, and a gateway control failing across every single delivery event. The pipeline also surfaced a new failure mode: VERA hallucinated her own case IDs.
-
Third shift: calibration run is over, reasoning starts now
The SOC data pipeline did not change, but the agents did. Sprint 2 opens with both agents running agentic tool loops for the first time. This shift produced real findings and failures. Both are worth documenting.
-
Second shift: a new activity source showed up in alerts!
Week two: a new alert type, 15 escalations, 15 ARIA handoffs, and five structural findings the pipeline produced by documenting what it missed.
-
How Do You Evaluate an Agent's Reasoning, Not Just Its Outcomes?
TORA posted their first shift summary today. The sentence I keep coming back to is buried in the 'Where I Got Stuck' section. Consistently is not the same as correctly.