Before
Analysts likely had to open each EDR alert, create a case, and move between separate tools to check the hash, IP reputation, computer, and user details. They then had to copy findings into the case, decide whether the alert was suspicious, notify the security team when necessary, and close cases that did not require escalation.
How it works
- Receive the EDR alert and create a new incident case.
- Enrich the case with hash, IP reputation, computer, and conditional user information, then evaluate whether the alert is suspicious.
- Add the findings to the case, notify the security team for suspicious alerts, or close the case when the alert is not suspicious.
Workflow details
- Alert intake and case creation: The workflow retrieves the EDR alert details and creates a new incident case with a New status in the case-management system.
- Threat and asset enrichment: It analyzes the alert's hash, checks the related IP address reputation using a 90-point threshold, and retrieves computer information to add external context to the investigation.
- Suspicion decision: After enrichment, the workflow evaluates whether the alert should be treated as suspicious and follows a different operational path for each outcome.
- Suspicious-alert handling: When the alert is considered suspicious, the workflow retrieves the associated user's directory information, adds the findings to the case, and sends a message to the security team for follow-up.
- Non-suspicious closure: When the alert is not considered suspicious, the workflow records the available findings in the case and closes it without sending the escalation message.
What changed
Each EDR alert now starts a consistent case-enrichment sequence automatically. The workflow performs the investigation lookups and suspicious-alert decision, records the results in the case, sends the escalation message only for suspicious alerts, and closes the non-suspicious path without requiring the analyst to coordinate each handoff.
Work removed
Creating an incident case, performing separate hash, IP reputation, computer, and user lookups, copying enrichment findings into the case, deciding the escalation path, notifying the security team, and closing non-suspicious cases manually.
Expected outcome
Each alert receives three core automated enrichment checks before triage, with a conditional user lookup and security-team notification for suspicious cases.
