Before
Analysts had to search SIEM, identity, endpoint, and security-incident consoles separately, then correlate users, IPs, URLs, timestamps, and related incidents by hand. They also had to find or create the GLPI record, write the rationale, and notify the appropriate analyst before routing the alert.
How it works
- Receive the alert and run the relevant SIEM, identity, endpoint, and incident evidence checks.
- Correlate the results, validate the AI verdict and confidence against the 0.9 threshold, and select close, contain, or ask.
- Create or update the GLPI record, close eligible false positives, prepare containment, or request an analyst decision in Teams.
Workflow details
- Alert preparation: A TLS-only webhook receives an investigated Logpoint alert, extracts key indicators such as the user, source IP, URL, host, timestamp, and alert rule, and selects the relevant reference searches.
- Evidence correlation: Up to three configured searches run in parallel, while Microsoft 365 sign-ins, recent Defender incidents, Okta authentication activity, and endpoint security data are collected. The workflow compares identity and network evidence, including IP changes and short timing gaps that may indicate token theft.
- AI assessment: The evidence is consolidated into an investigation pack for a triage verdict of true positive, false positive, or undetermined. The result is validated, confidence is constrained to a 0–1 range, and a 0.9 threshold determines whether the case can be routed automatically or requires review.
- Disposition and recordkeeping: The workflow finds an existing GLPI ticket or creates one, stores the verdict and rationale, and then closes false positives, prepares containment handling, or sends an Adaptive Card to the on-duty analyst in Teams. With automatic containment disabled, containment remains in shadow mode until an analyst approves it; unanswered cases remain open for the SOC.
What changed
Each alert now produces a structured evidence pack and validated routing decision without requiring analysts to change consoles for the initial investigation. GLPI is updated automatically, while only uncertain cases or analyst-approved containment decisions require human action; automatic containment is currently kept in shadow mode.
Work removed
Running repeated searches across SIEM, identity, endpoint, and incident tools; comparing IPs, countries, timestamps, and user evidence; looking up related incidents; finding or creating GLPI tickets; copying rationale into records; and manually notifying the on-duty analyst.
Expected outcome
At least four recurring cross-system evidence lookups and associated handoffs are removed per alert, with a documented disposition available in GLPI and a clear escalation path for unresolved cases.
