Before
An investigator translated each investigation question into a search, selected the relevant search pattern, supplied entities and a time window, and submitted the searches individually. They then retrieved and copied results back into the case while identifying unsupported requests before execution.
How it works
- Receive investigation requests and translate supported intents into bounded searches using the supplied parameters.
- Validate each search, execute supported requests, retrieve the results, and skip requests that are unsupported or incomplete.
- Assemble the evidence by original request and return a consistent package for the calling investigation workflow.
Workflow details
- Request intake: The workflow receives investigation queries containing an intent, parameters, and optional time and result limits.
- Search preparation: Each request is matched to a supported investigation pattern, with supplied values escaped, time windows validated, and result limits bounded before the search is submitted.
- Automated execution: Supported searches run in Splunk with a blocking execution window of up to 60 seconds, while unsupported or incomplete requests are skipped rather than executed.
- Evidence retrieval: The workflow retrieves completed search results, classifies each request as successful, empty, errored, or unsupported, and preserves the returned evidence rows.
- Consistent handoff: Results are assembled by request and returned in a standard package so a calling investigation workflow can use the evidence without reconstructing the search context.
What changed
Investigation requests now move through validation, bounded search execution, result retrieval, and request-level classification automatically. The calling workflow receives a consistent evidence package, while unsupported, empty, and failed searches are distinguished without requiring the investigator to manage each search job manually.
Work removed
Constructing searches from investigation questions, checking whether each request is supported, submitting searches one by one, retrieving result sets, and matching each result set back to its original request.
Expected outcome
For supported requests, the walkthrough indicates a potential reduction from about 10 minutes of analyst search work to roughly 3 seconds of automated retrieval; actual runtime varies by search and environment.
