Before
Security analysts likely had to collect recent malware samples, filter out known signatures, search network telemetry for each hash, and manually correlate matching hosts. They then had to move findings into an alert, coordinate containment decisions, perform EDR follow-up actions, and document the response across separate tools.
How it works
- On a recurring schedule, collect recent unsigned malware samples, extract their hashes, and search the network for matching activity.
- If affected hosts are found, summarize the evidence in Slack and wait for an authorized choice to quarantine, remediate, or close the incident.
- Execute the approved Darktrace or EDR action for the impacted hosts, run a follow-up detection check when applicable, and update the incident thread with the action and timestamp.
Workflow details
- Scheduled threat intelligence collection: The workflow runs on a recurring schedule defined by the threat-hunting strategy and retrieves recent malware samples from a threat intelligence source. It filters the results to focus on samples without a known signature, then extracts their hashes and related metadata.
- Network-wide validation: For each selected malware sample, the workflow searches Darktrace network data for matching file hashes within the recent search window. It removes irrelevant results, checks whether any hosts were identified, and prepares a structured summary containing the file hash, name, type, first-seen time, and affected hosts.
- Actionable incident alerting: When network matches are found, a detailed alert is posted to the responsible Slack channel. The alert gives the team explicit choices to quarantine, remediate, or close the case, while no-hit searches follow a successful completion path without generating an incident alert.
- Approved containment and remediation: If quarantine is selected, the workflow presents available Darktrace response actions, including host quarantine, blocking incoming or outgoing traffic, or enforcing a policy. After approval, the selected action is dispatched to each impacted host; if remediation is selected, the workflow creates high-severity SHA-256 custom indicators with a prevent action and retroactive detection enabled, then performs a follow-up device query.
- Documented closure: The workflow updates the Slack incident messages with the selected action, action owner, affected hosts, and timestamps. It can also prompt the team to continue with EDR remediation or close the case, preserving the response history in the conversation.
What changed
Threat hunting now runs on a recurring schedule and automatically connects malware intelligence to network evidence and affected hosts. Security staff receive a prepared Slack decision point instead of performing the searches and correlation themselves, while human approval remains required before containment, remediation, or closure actions are taken.
Work removed
Collecting and filtering recent malware samples; searching network telemetry for each hash; identifying and listing affected hosts; assembling incident details; manually notifying the response team; coordinating containment choices; creating EDR indicators; checking follow-up detections; and recording action owners and timestamps.
Expected outcome
A reasonable conservative estimate is that the workflow removes at least three manual review and handoff actions for each detected malware sample, while providing a consistent, timestamped path from network discovery to approved response.
