Before
Security analysts logged into Darktrace, located unacknowledged AI analyst incidents, reviewed each incident and its related context individually, and submitted acknowledgments manually. The team lacked an automated summary and a shared Slack-based record of who acknowledged each incident and when.
How it works
- Retrieve the pending AI analyst incidents from the previous seven days and collect relevant linked incident data.
- Generate concise analyst reports and post them in a shared Slack thread with interactive review and acknowledgment actions.
- Apply the analyst's selected acknowledgments in Darktrace or update the thread with the closure decision and timestamp.
Workflow details
- Trigger and retrieval: A recurring workflow run retrieves AI analyst incident events that remain unacknowledged from the previous seven days.
- Incident enrichment: Each incident is checked for group relationships, and linked incidents are retrieved and combined with the primary incident when relevant.
- Report generation: An AI agent creates concise plain-text reports covering the incident title, identifier, date, summary, chain of events, breach details, impacted assets, and the rationale and details for linked incidents.
- Team review: The workflow posts an initial notification to a shared Slack channel, then adds the generated reports to the message thread with interactive options for selecting incidents to acknowledge or closing the review.
- Decision handling: Selected incidents are acknowledged directly in Darktrace, while closure actions update the Slack message with the user's action and timestamp, creating a shared record of the review outcome.
What changed
Pending incidents and their linked context are collected and summarized automatically, then delivered to one shared Slack thread for review. The analyst still chooses which incidents to acknowledge or close, but the selected acknowledgment is submitted to Darktrace and the decision is recorded in the thread without a separate manual handoff.
Work removed
Logging into Darktrace, locating unacknowledged incidents, reading raw incident and linked-event data one by one, preparing individual summaries, copying findings into team communications, and submitting each acknowledgment manually.
Expected outcome
A conservative expected result is 5–10 minutes saved per review cycle, with more consistent coverage of pending incidents and a shared record of review decisions.
