Before
An analyst submitted each search, waited for the search job to finish, checked its status, and polled again when results were not ready. The analyst then collected and passed the returned rows to the investigation that requested them.
How it works
- Receive and submit the requested evidence search.
- Check whether results are complete, waiting and polling again if the search is still running.
- Normalize and return the result status, count, and selected rows to the calling investigation.
Workflow details
- Trigger: The workflow receives a structured search request containing a label, query, time range, repositories, and result limit from an investigation.
- Submission: It submits the requested search and waits briefly before checking for available evidence. In the supplied demonstration, the external response is replayed locally with synthetic data.
- Result polling: The workflow retrieves the search results, normalizes the response into a status, count, label, and rows, and limits the returned collection to the first 50 rows.
- Automated decision: It checks whether the search is complete. If the result is still running, it waits 10 seconds and performs one additional poll of the same search.
- Handoff: Once the search is complete, the normalized evidence rows are returned directly to the calling investigation, creating a consistent handoff without requiring an analyst to watch the search console.
What changed
Search completion checks and the follow-up poll now happen automatically, with results normalized and returned through a consistent handoff; the analyst only receives the evidence output instead of managing the search job.
Work removed
Submitting searches manually, watching for completion, checking the search status, waiting between polls, repeating an incomplete search check, and copying result rows into the requesting investigation.
Expected outcome
Each search can be handled with up to two automated result polls and a maximum 50-row handoff, reducing console monitoring during repeat investigations.
