Before
A hunter had to qualify each device and owner, review the matched indicators and evidence, and check whether the same hit had already been handled. New findings then required separate normalization, triage, intelligence-record updates, and host-response handoffs.
How it works
- Qualify the asset, assemble the hunt evidence, record indicator observations, and check for prior handling.
- Normalize each new finding and obtain a triage verdict and investigation ticket.
- Return benign results or request host response for true-positive and needs-investigation outcomes.
Workflow details
- Receive and qualify the hit: The workflow accepts one asset hit from a threat hunt, including its indicators, evidence, and hunt plan, then enriches the device with its identity, IP at the time of the hit, configuration context, and owner information.
- Control duplicate work: It assembles a consistent finding and checks whether the same indicator and asset combination has already been handled. Previously handled hits return as duplicates, while new hits continue for investigation.
- Record intelligence observations: Each identified indicator receives an internal observation containing its value, associated asset, hunt timing, occurrence history, and recent sightings. Repeated processing of the same hunt and asset does not increment the observation again.
- Normalize and triage: New findings are normalized and passed to the shared assessment flow, which returns a verdict and investigation ticket for the asset.
- Route the outcome: Benign findings are returned without a response request. True-positive or needs-investigation verdicts are sent to the host-response flow, and the resulting response decision and launch status are included in the final record.
What changed
Each asset hit now follows a consistent automated path from enrichment and duplicate checking through normalization and triage, with observations recorded as part of processing. Benign hits are closed with a status, while qualifying verdicts automatically create the host-response handoff and return its decision.
Work removed
Manually qualifying each asset and owner, checking duplicate-hit records, carrying evidence between triage workflows, creating repeated indicator observations, packaging findings for assessment, and initiating host-response requests.
Expected outcome
Each new asset hit produces one consistent, deduplicated investigation record and, when warranted, one host-response request without reopening the same hit during the 14-day duplicate window.
