AI in Log Onboarding Workflow

@ SentinelOne

Overview

Log onboarding — connecting and configuring log sources so a security platform can ingest and analyze them — is one of the more technical, high-friction workflows in a SOC (Security Operations Center) product. The team wanted to explore whether a conversational AI agent could make this process easier by guiding users step-by-step through a chat interface.

The working assumption was straightforward: if users could just ask the agent what to do next, onboarding would feel faster and less intimidating.

I was brought in to concept test this idea with real users before the team invested further in the conversational design.

Research Goals

  • Understand the pain points users experience in log onboarding today

  • Identify which log sources users need to onboard first to see value quickly

  • Understand where users were comfortable with the AI agent acting autonomously versus where they wanted a manual review checkpoint

  • Validate the conversational-AI approach as a guide through the onboarding flow

  • Determine which steps in the flow were genuinely needed versus could be removed or simplified

Method

I conducted 1-hour interview sessions with 12 users over the course of 2 weeks. Each session followed a two-part structure:

  • Discovery — open-ended questions to understand each participant's current log onboarding experience, pain points, and workflow before introducing any concepts

  • Concept testing — walking through the proposed conversational-AI onboarding flow to gather reactions, expectations, and objections

At the end of each session, I collected usefulness and satisfaction ratings on a 1–5 scale, which allowed me to track how perceptions shifted as the design evolved between rounds.

Findings

Early concept testing surfaced a mismatch between the proposed solution and how technical users actually think about this workflow.

  • The chat interface wasn't solving the real problem. Users didn't see much value in conversing with an agent to click through setup steps. They were comfortable following documentation and moving through a guided click-through flow on their own.

  • The real pain point was downstream. Parsing and normalizing log data — not the initial setup — was consistently identified as the hardest, most frustrating part of onboarding. That's where users wanted support.

  • Users wanted the agent to handle complexity, not simplicity. Rather than using the agent to walk through a series of straightforward selections, users wanted it reserved for the harder, more ambiguous problems — troubleshooting when something didn't work as expected.

Research Impact

Product change

  • Increased usefulness and satisfaction score

    • Once the designers added more information on how the agent troubleshooted and solved problems, the usefulness and satisfaction score increased amongst users

  • Directed Product Strategy

    • The insights found during this round of research prompted designers and product managers to re-think where AI should be incorporated in a workflow instead of placing it in places that simply didn’t need it.