Before
Analysts manually collected related alerts and entities, compared the available evidence, and wrote their assessment into the incident. They then had to decide whether to close the case, initiate containment, or hand it to another analyst for review.
How it works
- Receive the incident, retrieve its alerts and entities, and organize the evidence for analysis.
- Validate the AI-generated verdict, confidence, rationale, and permitted response actions, then record the assessment in the incident.
- Automatically remediate qualifying high-confidence true positives; otherwise, request an analyst decision to close, remediate, or leave the case for later handling.
Workflow details
- Evidence collection: When an incident is received, the workflow extracts its identity, severity, status, description, owner, and labels, then retrieves related alerts and entities such as hosts, accounts, IP addresses, hashes, URLs, and domains.
- Evidence assessment: An AI analyst reviews the supplied incident data, validates the verdict and confidence, limits recommended actions to supported containment types, and prepares a summary, rationale, indicators, and proposed actions.
- Incident record: The workflow adds the assessment, facts, confidence, and recommended actions back to the incident so the reasoning and response path remain traceable.
- Automated response: A true-positive verdict with confidence above 0.9 and at least one valid targeted action proceeds directly to the remediation flow without waiting for an analyst.
- Human decision path: Other cases are presented in a Teams card with options to remediate, classify the incident as a false positive, or ignore it. The workflow closes false positives, executes analyst-approved remediation, or records that no action was taken when the analyst ignores or does not answer within four hours.
What changed
Evidence gathering, verdict validation, documentation, and response routing now occur in one workflow. High-confidence true positives can proceed to remediation automatically, while uncertain cases arrive in Teams with explicit analyst choices and a four-hour response window.
Work removed
Collecting related alerts and entities one by one, organizing evidence for review, writing the assessment into the incident, preparing the response decision, and manually routing lower-confidence cases to an analyst.
Expected outcome
A conservative estimate is three recurring manual actions avoided per incident: gathering evidence, documenting the assessment, and routing the decision, while preserving a traceable outcome for every branch.
