Example Investigation Workflow
This example shows how a typical alert moves through AI SOC from ingestion to resolution.
Scenario: A SIEM alert indicates suspicious network activity from an internal host to an external IP address.
- Ingestion: The SIEM alert is ingested via webhook and a Case Management record is created (tracking prefix CASE-)
- Observable Extraction: Observables are automatically extracted:
- Source IP (internal host)
- Destination IP (external IP)
- Timestamp and protocol information
- Threat Intelligence Enrichment: Observables are enriched with TI providers:
- External IP is flagged as malicious by multiple providers
- Threat Intelligence Verdict: Malicious
- Enrichment status: Complete
- Triage Review: Analyst opens Case Management and reviews:
- Severity: High
- Intelligence Verdict: Malicious
- Observables: Source and destination IPs
- Correlation: No similar signals found
- Plan Generation: Analyst clicks Generate Plan:
- Preparation phase: Enrich destination IP with additional TI providers, get endpoint details for source host
- Analysis phase: Search SIEM for related activity, check for similar infections, get user details
- Determination phase: Generate verdict
- Investigation Execution:
- Preparation steps confirm the external IP is malicious
- Analysis steps reveal the internal host has multiple connections to the malicious IP
- User details show the account belongs to a standard user (not admin)
- Verdict Generation: Determination step generates verdict:
- AI Verdict: Malicious
- Confidence: 8/10
- Analysis indicates potential C2 communication
- Response and status: Analyst continues on the same Case Management record:
- Attaches or references evidence (TI results, SIEM logs, endpoint details) per your layout
- Documents findings in investigation comments (and linked case comments if your workflow uses a linked record)
- Status may move to Escalated when pending CASE resolution and your tenant rules apply
- Remediation: Analyst generates remediation plan:
- Isolate affected endpoint
- Block malicious IP at firewall
- Reset user credentials
- Scan for additional infections
- Automation: Analyst creates a triage rule:
- Condition: External IP matches known malicious IPs from TI
- Action: Run associated playbooks (for example notify, set priority, or containment steps your organization defines)
- Future matching Case Management records are processed by the rule when enabled
- Resolution: Record is tracked through mitigation and closed with full audit trail
Related Documentation
- ο»ΏGetting StartedGetting Started - Your first signal investigation
- ο»ΏAI SOC ApplicationsAI SOC Applications - Detailed application walkthroughs
- ο»ΏDashboards and ReportsDashboards and Reports - Monitoring and metrics
- ο»ΏOperational Best PracticesOperational Best Practices - Optimization and efficiency tips
- ο»ΏTroubleshootingTroubleshooting - Common issues and solutions