Before
An analyst would review the alert, identify affected devices, retrieve host details, and open remote response sessions one host at a time. They would then run multiple read-only checks, record the results, close each session, and manually assemble the evidence into a summary and escalation recommendation.
How it works
- Receive the alert context and identify the relevant devices and investigation scope.
- Retrieve device information, open controlled read-only host sessions, and collect process, network, file, persistence, user, and environment evidence as applicable.
- Close the sessions and provide the human analyst with a consolidated investigation summary and verdict recommendation.
Workflow details
- Alert intake: The workflow receives the alert context and requested investigation actions, then uses them to determine which hosts and evidence are relevant to the investigation.
- Host preparation: For each relevant device, it retrieves device metadata before establishing a controlled remote response session and limits concurrent sessions to avoid platform throttling.
- Evidence collection: The agent performs read-only checks of running processes, active network connections, relevant files, persistence locations, logged-in users, and environment variables where applicable. These checks are used to identify suspicious activity, command-and-control indicators, lateral movement, persistence mechanisms, or account exposure.
- Session management: After the investigation is complete for each host, the workflow closes the remote response session cleanly and avoids destructive or administrative actions.
- Analyst handoff: The workflow compiles the commands performed, important findings, the current state of the primary target host, and a verdict recommendation for a human analyst to review and use for further response or escalation.
What changed
A single alert request now initiates a standardized, read-only host investigation across relevant devices, including session cleanup and evidence consolidation. The analyst receives the findings and recommendation in one summary, while the final response or escalation decision remains with the human reviewer.
Work removed
Manually identifying affected hosts, retrieving device details, opening and closing remote response sessions, running repeated host evidence checks, copying findings into an investigation record, and drafting the initial verdict recommendation.
Expected outcome
A repeatable live investigation summary for each alert, with up to six standard evidence-check categories per relevant host automated where applicable and the initial verdict recommendation prepared for analyst review.
