Before
An analyst likely had to search alerts, detects, indicators, and device records separately to determine how broadly a hash had executed. They also had to gather details for the primary host, compare the findings, and write a recommendation for the incident queue.
How it works
- Receive the alert context and requested investigation actions.
- Search indicator, alert, detect, and device records, then validate the primary host and measure fleet prevalence.
- Compile the evidence into a triage summary with a recommendation for human analyst review.
Workflow details
- Trigger and context: The workflow starts when it receives an incident context and a set of requested actions through a Flowhook event, giving the investigation agent the information needed to begin alert enrichment.
- Security data gathering: The agent searches available alert, detect, indicator, and device data to identify relevant metadata, locate affected devices, and determine where the investigated hash has executed across the fleet.
- Host validation: It retrieves additional telemetry for the primary target host, host-01.example.local, so the analyst receives specific device-level context rather than only aggregate findings.
- Automated assessment: The agent compares fleet prevalence and host details to form a final recommendation about whether the alert is likely a widespread false positive associated with Microsoft Defender orchestration or an isolated, anomalous execution.
- Analyst-ready result: The findings are compiled into a concise triage summary and returned as the workflow result for review by a human incident responder.
What changed
The investigation now gathers cross-source evidence and performs the fleet-prevalence and primary-host checks automatically after the alert context arrives. The human analyst receives a prepared summary and recommendation instead of starting with separate lookups and manual comparison, while final review remains with the analyst.
Work removed
Repeatedly searching alert, detect, indicator, and device records; identifying machines where the hash executed; retrieving primary-host telemetry; comparing fleet prevalence with host-specific findings; and manually writing the initial triage recommendation.
Expected outcome
The workflow can replace at least two major manual investigation stages—fleet prevalence lookup and primary-host validation—with a single analyst-ready triage summary.
