Before
An analyst would likely open the endpoint security console, search deep-visibility data, review agents, and investigate related indicators and threats separately. The analyst would then interpret the findings and determine the next action before sharing the result with the requester or another team.
How it works
- Receive the endpoint security investigation request through the workflow trigger.
- Analyze relevant visibility, agent, indicator, and threat data while applying automated reasoning to determine what action is appropriate.
- Return the agent's investigation result and actions as the completed workflow output.
Workflow details
- Trigger: The workflow starts when a Flowhook request is received, providing the event or investigation context for the security task.
- Investigation scope: An AI agent uses the available endpoint security capabilities to examine deep visibility data, managed agents, indicators of compromise, and threat information.
- Automated reasoning: The agent interprets the available findings, connects relevant security evidence, and determines how to act based on the investigation context.
- Operational action: The workflow allows the agent to carry out the appropriate available security operations rather than stopping at data collection or analysis.
- Result delivery: The agent's result is passed to the success step and returned as the workflow output for downstream use or review.
What changed
The investigation now begins automatically from an incoming request and combines the available endpoint security checks in one agent-driven stage. The reasoning and resulting action are returned directly through the workflow instead of requiring separate analyst searches and manual result compilation.
Work removed
Opening the endpoint security console, searching deep-visibility records, reviewing agent information, checking related indicators and threats, correlating findings, and manually compiling the investigation result.
Expected outcome
A consolidated endpoint threat investigation is produced through one automated workflow, removing multiple manual lookup and handoff steps without requiring a separate measured performance claim.
