Before
A responder manually gathered prior sightings, allowlist status, and external intelligence before deciding how confidently to classify each alert. The resulting disposition then had to be recorded consistently in both the security ticket and the originating SIEM case.
How it works
- Collect internal and external evidence for the alert's observables, using allowlist and prior-sighting context to focus external research on unknown indicators.
- Generate a structured, source-cited verdict and apply validation rules that downgrade unsupported or contradictory conclusions to further investigation.
- Create or update the security ticket and route the SIEM case for analyst review, or close it only when the configured automatic-closure conditions are met.
Workflow details
- Evidence collection: The flow receives a normalized alert and SIEM results, extracts up to 50 valid observables, checks internal intelligence and prior sightings, and excludes allowlisted indicators from further investigation.
- External enrichment: Indicators absent from local intelligence are sent for external research, using successive intelligence sources to add context only where the internal cache has no match.
- Cited assessment: An analyst agent evaluates the alert and enrichment, returning a structured verdict, confidence, evidence citations, indicators, recommended actions, and missing context.
- Safety validation: The workflow normalizes unsupported values, checks evidence presence, detects malicious indicators that contradict a benign verdict, and permits automatic closure only for a high-confidence benign or false-positive result without guard flags.
- Case routing: A deduplicated security ticket is opened or updated, while the originating SIEM case is marked in progress for analyst attention or closed when automatic closure is enabled and all conditions are satisfied.
What changed
Evidence gathering, verdict formatting, contradiction checks, ticket deduplication, and cross-system status updates now occur in one workflow. Analysts receive alerts that remain open when evidence is insufficient or conflicting, while only explicitly enabled, high-confidence benign or false-positive cases can be closed automatically.
Work removed
Manually checking observables against local intelligence and allowlists, researching unknown indicators, assembling evidence for a verdict, and copying the disposition into the security ticket and SIEM case.
Expected outcome
Each alert receives a consistent evidence-backed disposition and removes at least two recurring cross-system transcription steps: updating the security ticket and updating the originating SIEM case.
