Before
Analysts likely searched existing incident records manually using unique identifiers and then repeated searches across host, IP, user, vendor, and threat details to find related cases. They also had to interpret alert and enrichment data, assemble ticket content, create remediation tasks, and coordinate parent incident grouping through repeated copy-and-paste handoffs.
How it works
- Receive the incident context, check its unique identifier for duplicates, and stop processing when an existing match is found.
- Assess the alert and route it through automated triage and, when needed, endpoint or threat-intelligence enrichment to determine severity, confidence, evidence, and recommended actions.
- Create the structured incident Story and remediation tasks, search recent records for correlation, and attach the Story to an existing or newly created parent Epic when related activity is confirmed.
Workflow details
- Intake and duplicate control: The workflow receives an incident context from an upstream event handler, including available enrichment and ticket information. It checks the incident's unique identifier against existing records and stops duplicate processing when a match is found.
- Triage and enrichment: For unique incidents, an automated triage assessment reviews the alert context, affected assets, threat objects, indicators of compromise, source vendor, and rule status. When further investigation is needed, specialized enrichment agents gather additional endpoint and threat-intelligence context, after which the workflow determines a preliminary or final verdict, confidence level, and recommended response actions.
- Structured incident creation: The workflow converts the assessment into a structured ticket containing the alert title, priority, affected entity type, incident date, reasoning, evidence, IOCs, enrichment results, and recommended remediation. It also creates remediation task records from the identified actions; the workflow prepares and assigns the work but does not itself execute the listed containment actions.
- Correlation and grouping: A script extracts identifiers such as risk objects, source values, IP addresses, users, vendors, and threat objects, removes duplicates, and generates up to five relevant search patterns for incidents created within the previous 72 hours. Matching records are reviewed for shared IOCs, entities, or related activity.
- Incident organization: When related incidents are found, the workflow either uses an existing parent Epic or creates one with a common incident theme, description, and shared IOCs, then associates the new Story with that parent. Unique incidents remain available as standalone structured cases, while duplicate incidents are reported without creating another record.
What changed
Duplicate detection, triage, enrichment routing, IOC extraction, ticket assembly, remediation-task creation, and recent-incident correlation now happen within one automated path. Analysts receive a structured incident record with evidence and recommended actions, while human teams retain control over approving or executing remediation and containment work.
Work removed
Manually checking unique identifiers for duplicates, searching recent incidents across multiple IOC and entity fields, reviewing enrichment sources one by one, copying alert details into ticket templates, extracting IOCs, creating remediation tasks, and manually grouping related Stories under a parent Epic.
Expected outcome
A conservative expected outcome is that each unique alert can generate up to five automated correlation search patterns and a complete incident record with remediation tasks, replacing repeated searches and manual ticket assembly without claiming a measured response-time improvement.
