---
title: Example Investigation Workflow
slug: solutions/example-investigation-workflow
docTags: 
createdAt: 2026-03-04T10:49:54.989Z
---

This example shows how a typical alert moves through AI SOC from ingestion to resolution.

**Scenario:** A SIEM alert indicates suspicious network activity from an internal host to an external IP address.

1. **Ingestion:** The SIEM alert is ingested via webhook and a **Case Management** record is created (tracking prefix **CASE-**)
2. **Observable Extraction:** Observables are automatically extracted:
   - Source IP (internal host)
   - Destination IP (external IP)
   - Timestamp and protocol information
3. **Threat Intelligence Enrichment:** Observables are enriched with TI providers:
   - External IP is flagged as malicious by multiple providers
   - Threat Intelligence Verdict: **Malicious**
   - Enrichment status: **Complete**
4. **Triage Review:** Analyst opens **Case Management** and reviews:
   - **Severity:** High
   - **Intelligence Verdict:** Malicious
   - **Observables:** Source and destination IPs
   - **Correlation:** No similar signals found
5. **Plan Generation:** Analyst clicks **Generate Plan**:
   - Preparation phase: Enrich destination IP with additional TI providers, get endpoint details for source host
   - Analysis phase: Search SIEM for related activity, check for similar infections, get user details
   - Determination phase: Generate verdict
6. **Investigation Execution:**
   - Preparation steps confirm the external IP is malicious
   - Analysis steps reveal the internal host has multiple connections to the malicious IP
   - User details show the account belongs to a standard user (not admin)
7. **Verdict Generation:** Determination step generates verdict:
   - AI Verdict: **Malicious**
   - Confidence: 8/10
   - Analysis indicates potential C2 communication
8. **Response and status:** Analyst continues on the same **Case Management** record:
   - Attaches or references evidence (TI results, SIEM logs, endpoint details) per your layout
   - Documents findings in investigation comments (and linked case comments if your workflow uses a linked record)
   - **Status** may move to **Escalated** when **pending CASE resolution** and your tenant rules apply
9. **Remediation:** Analyst generates remediation plan:
   - Isolate affected endpoint
   - Block malicious IP at firewall
   - Reset user credentials
   - Scan for additional infections
10. **Automation:** Analyst creates a triage rule:
    - Condition: External IP matches known malicious IPs from TI
    - Action: Run associated playbooks (for example notify, set priority, or containment steps your organization defines)
    - Future matching **Case Management** records are processed by the rule when enabled
11. **Resolution:** Record is tracked through mitigation and closed with full audit trail

## Related Documentation

- [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) - Your first signal investigation
- [AI SOC Applications](docId\:UOSUZRpSl6hFe9d6Br5az) - Detailed application walkthroughs
- [Dashboards and Reports](docId\:deVHsmAt40H1MlpUcMEnr) - Monitoring and metrics
- [Operational Best Practices](docId\:wW_GfWujLJT7OpjDuU8vg) - Optimization and efficiency tips
- [Troubleshooting](docId\:cKnuXQV85k9lu0OCqV218) - Common issues and solutions