Before
Analysts likely reviewed the CrowdStrike and Lacework alerts separately, switched between alert records, and manually compared timestamps, affected entities, and actions. They then wrote a short incident summary and copied it into a team message for review.
How it works
- A triggered case gathers the relevant endpoint and cloud security alert details.
- The alerts are supplied together to an AI completion that correlates them and creates a concise, human-readable ticket summary.
- The normalized summary is formatted and posted to a team channel for analyst follow-up.
Workflow details
- Trigger and alert collection: The flow starts when a case is triggered and gathers alert information from CrowdStrike and Lacework, including severity, timestamps, affected systems or resources, users, source details, actions taken, and recommendations.
- Cross-alert correlation: The collected alerts are provided together so the workflow can relate the endpoint malware detection to the cloud unauthorized-access event and explain how one action may have led to another.
- AI normalization: An OpenAI completion generates a short abstract written for a basic human reader, turning the raw alert information into a ticket-style summary rather than requiring analysts to interpret each source separately.
- Operational handoff: The generated abstract is inserted into a formatted message labeled as a normalized alert, with the correlated explanation clearly separated for recipients.
- Team notification: The completed summary is posted to a Slack channel, giving the security team a shared starting point for investigation and any follow-up decisions.
What changed
Correlation, summary drafting, message formatting, and channel delivery now happen automatically after the case is triggered; analysts receive a shared normalized summary and retain responsibility for investigation and response decisions.
Work removed
Analysts no longer need to review the two alert records separately, manually compare their details, write the correlated abstract, format the notification, and copy it into the team channel.
Expected outcome
Up to four recurring manual actions per case—cross-alert comparison, summary writing, formatting, and notification—are consolidated into one automated handoff.
