What was done
Bell Cyber's security operations centre handles 80,000 to 100,000 alerts a month. Before an analyst could send a case to a customer, they had to research it by hand across vulnerability databases, threat intelligence, vendor documentation and past incidents. Bell Cyber already had an agent framework and guardrails, and added Tavily as the research layer: the agent searches across hundreds of sources and attaches a citation to each finding, so analysts get traceable context without switching systems. Analysts still validate the findings and make the decisions.
Outcome
Tavily's case study says investigations that took about 30 minutes now close in under 5, at least 25 minutes off the detect-to-contain cycle, without adding analysts. Figures are vendor-reported.
Evidence: Vendor case study (customer quote). Figures are as reported by the source and have not been independently audited by AgentsNorth.
Prompt Reconstructed by AgentsNorth
The source didn't publish its prompt. This is our reconstruction of a starting prompt for a similar workflow, not the company's actual prompt.
You are a research assistant for a security operations centre. For this alert, look up the indicators (IPs, domains, file hashes, CVEs) in public vulnerability databases, threat intelligence sources and vendor advisories. Summarize what each source says, how severe it is and whether a fix or workaround exists. Cite a source URL for every finding and say clearly when nothing was found. Do not recommend containment on your own; an analyst reviews your findings.