Before
Analysts had to search endpoint records and manually cross-check network history when a hit was identified by IP. They then switched to the configuration management and identity records to confirm the asset, owner, criticality, and account details before sending the context back to the hunt.
How it works
- Receive the hunt hit and search endpoint records using the available agent ID or source IP.
- Validate IP ownership at the hit time when required, then match the endpoint to its configuration item and owner profile.
- Return the qualified asset, criticality, confidence level, owner context, and any exceptions to the hunt.
Workflow details
- Trigger and candidate search: The workflow receives a hunt hit with an optional endpoint agent ID, source IP, and event timestamp, then searches endpoint records to identify the most likely device.
- Historical validation: When the device is found by IP, the workflow checks network address history and compares the recorded assignment with the time of the hit. It marks the mapping as high confidence for a direct agent-ID match, medium when the IP is confirmed historically, or low when the assignment cannot be confirmed.
- Asset and identity enrichment: The selected endpoint is matched to its configuration item to retrieve ownership, support group, and criticality. If criticality is unavailable, it is inferred from the endpoint type and documented in the notes; the owner profile is then enriched with department, title, manager, and account status when available.
- Qualification and handoff: The workflow returns the asset, owner, confidence level, and exception notes to the calling hunt. The supplied website demonstration uses simulated connector responses and does not change external tickets or accounts.
What changed
The hunt receives device, asset, ownership, criticality, confidence, and exception details in one result. Direct agent-ID matches and historically confirmed IP matches are classified automatically, while missing records or unresolved assignments remain clearly flagged for human review.
Work removed
Searching endpoint records, comparing IP history with the hit time, locating configuration items, copying owner and criticality details, and assembling the qualification result for the hunt.
Expected outcome
Expected outcome: Up to four recurring lookup or cross-check actions are consolidated per hunt hit, with uncertain mappings and missing records explicitly identified.
