Use Case Intelligence RSS Search use cases Search
LangChain Software / SaaS Global

Trellix

IT Operations Automation · Security and Compliance

Trellix needed to reduce a backlog of cybersecurity integration and log-parsing requests that forced engineers to spend days deciphering syslog data, coding plugins, and coordinating with customers by hand.

Read the original story Explore all use cases
2 to 3 days deciphering logs, coding integrations, and managing customer communications
40,000+ customers
multiple days, could now be written during the better part of an afternoon
reducing the time required for manual parsing from days to minutes.

Reported impact

Business outcome

Trellix cut parsing and integration turnaround from days to minutes or afternoons, reduced backlog pressure on engineers, and improved customer and stakeholder confidence by making agent behavior measurable and explainable.

  • Customer Experience
  • Productivity Improvement
  • Speed to Market

Solution

Trellix built Sidekick as an internal agentic platform for log parsing, parser generation, and integration development on top of LangGraph and LangSmith. The engineering team assembled several smaller subgraphs that use low-level LangGraph features such as Send API and subgraph calling to fan work out efficiently, then composed those building blocks into larger end-to-end graphs for parsing syslog formats and generating SaaS plugins. Human-in-the-loop controls let engineers pause, approve, rewind, or restart steps during development without rerunning everything. LangGraph Studio visualizes those workflows for both developers and business stakeholders, making the reasoning path easier to explain. LangSmith then compares agent architectures through datasets and experiments, tracks recursion and must-include rates, and exposes structured node inputs and outputs so production issues are easier to debug than in raw AWS logs.

Data flow

Syslog samples and API-documentation tasks enter Sidekick, LangGraph subgraphs fan parsing and generation work out through Send API and compose the results into larger workflows, humans can pause or rewind steps when needed, and LangSmith records experiments plus node-level traces to compare architectures and debug issues.

Solution architecture

5 components · 3 layers
  1. Serving
    • Sidekick Automates log parsing, parser generation, and integration work for Trellix engineering teams.
  2. Orchestration
    • LangGraph Defines the modular agent workflows and composes subgraphs into larger parsing and integration graphs.
    • Send API Enables map-reduce style fan-out and efficient coordination across the Sidekick subgraphs.
  3. Governance
    • LangGraph Studio Visualizes the workflow so engineers and business stakeholders can inspect agent behavior.
    • LangSmith Runs experiments, tracks metrics, and provides trace-based debugging for Sidekick.

Architecture clues

  • Human-in-the-loop controls allow pause, approval, rewind, and restart during testing.
  • LangSmith tracks recursion rate and must-include rate across app versions.
  • Sidekick uses subgraphs as reusable modules before composing them into larger graphs.

Evidence from the source

2 to 3 days deciphering logs, coding integrations, and managing customer communications
LangGraph Studio played a crucial role in the development of Sidekick
monitored key metrics such as recursion rate
plugins, traditionally being written during the course of multiple days, could now be written during the better part of an afternoon
reducing the time required for manual parsing from days to minutes.
Transparency Evidence & methodology 90/100 reference value · 89% confidence · 1 source

Review how this reference was scored and trace each normalized claim back to its documented source.

01

Scoring methodology

How scores are calculated

Customer Reference Value measures usefulness as a customer reference. Evidence Confidence measures the quality and traceability of available evidence, not independent verification.

Customer reference value90/100
  • Problem clarity20/20
    Measures whether the customer's operational problem is specific enough to compare.
  • Implementation depth25/25
    Rewards named components, data flow, integrations, and architecture detail.
  • Outcome specificity20/20
    Measures whether the reported benefit is concrete rather than a generic claim.
  • Quantified impact15/25
    1 metric describe measurable impact.
  • Deployment scale10/10
    Rewards evidence of a live or scaled deployment and meaningful integration scope.
Evidence confidence89%
  • Source authority20/25
    The main evidence is an official vendor-published customer story.
  • Claim traceability21/25
    10 of 12 key fields link to a named source.
  • Direct evidence20/20
    5 direct source quotes retained.
  • Date provenance10/10
    The publication date comes from the source page or publisher.
  • Source transparency8/10
    1 source reference document publisher, URL, authority, retrieval, and supported fields.
  • Implementation specificity10/10
    Rewards source-backed components, data flow, quantified impact, and a specific outcome.
02

Traceability

Sources & provenance

Field coverage shows which facts each source supports. Dates are shown only when documented by the source.

  1. LangChain

    Trellix customer story

    First-party
    https://blog.langchain.dev/customers-trellix/
    Source type
    Vendor-published customer story
    Published
    Apr 22, 2025
    Supports
    • Customer
    • Business problem
    • Solution
    • Products
    • Solution components
    • Data flow
    • Integrations
    • technical area
    • use case category
    • Business outcome
    • outcome category
    • Metrics
    • Architecture
    • evidence quotes
    • Publication date

Date evidence

  • Published on source page Apr 22, 2025 · LangChain · First-party
    Open date source
Not separately sourced Industry, Region, Company size. Treat these normalized attributes as lower-confidence until a dedicated source is added.

Related

Similar use cases

See all like this
Google Cloud Modified · Oct 9, 2026 Replenit Software / SaaS Poland Legacy marketing tools often treat individual shoppers as spreadsheet averages, relying on broad customer segments and predictable, rigid automation rules. As a result, brands frequently blast customers with irrelevant,… 360% business growth in one quarter with Google Cloud IT Operations AutomationMarketing Personalization BigQuery · Cloud TPUs · Gemini Google Cloud Modified · Oct 9, 2026 Riafy Technologies Software / SaaS India Riafy Technologies began its journey with a clear mission: to build adaptable and accessible AI systems that operate natively at a global scale. Today, the company's consumer-end products support 125 million people… Cut incident diagnostics from 40 minutes to under 1 minute IT Operations AutomationSecurity and Compliance Cloud Run · Cloud SQL · Gemini Models OpenAI Oct 9, 2026 Sophos Software / SaaS Global Sophos needed to investigate and respond to a growing volume of cyber threats faster, while scaling its expertise across every protected customer without matching growth in scarce analyst headcount. 52% of MDR cases resolved end-to-end by AI IT Operations AutomationSecurity and Compliance OpenAI Daybreak · OpenAI models · Sophos Fusion