Before
Analysts had to interpret each SIEM's alert structure separately, extract users, hosts, indicators, and severity, and translate those details into a common investigation format. They also had to decide which initial evidence searches to run and repeat the work when similar activity appeared from another source.
How it works
- Receive a source-specific alert and translate its evidence into a common detection finding.
- Validate the translation, generate a deduplication key, and flag unsupported or unreadable alerts.
- Prepare targeted enrichment requests from the extracted entities and return the complete package to the calling investigation.
Workflow details
- Alert intake: The flow receives a raw alert with its source identified as Splunk, QRadar, Sentinel, or a qualified hunt result.
- Normalization: It maps source-specific evidence into a common OCSF Detection Finding, including the case, rule, title, severity, entities, observables, and source context. Sentinel incidents can include related alerts, while QRadar offenses can incorporate sampled event context.
- Validation: The workflow checks whether normalization succeeded. Unsupported or unreadable alerts are routed to a failure result rather than being passed into the investigation pipeline as incomplete findings.
- Deduplication: It creates a source- and entity-based deduplication key, generally incorporating the detection rule and day, so repeated activity can be recognized by downstream processes.
- Enrichment planning: It converts extracted users, hosts, IPs, domains, hashes, and emails into up to 12 initial investigation queries, using shorter or longer lookback windows according to the query intent, and returns them with the normalized finding.
What changed
Every supported alert now reaches the investigation pipeline in the same structure, with automated validation, deduplication data, source context, and initial enrichment requests prepared before analyst investigation begins.
Work removed
Manually translating vendor fields, extracting entities and observables, assigning a common finding structure, creating deduplication keys, selecting initial evidence searches, and rejecting unsupported alerts.
Expected outcome
Each normalized alert can replace one manual translation and search-planning pass while preparing up to 12 initial enrichment requests; actual time savings depend on alert complexity.
