Investigation Plan Workflow
The Generate Plan action creates an AI-powered investigation plan organized into phases. When signal context, evidence, or knowledge base guidance changes, Regenerate Investigation Plan or Regenerate Remediation Plan refreshes the plan without starting from an empty record. The AI SOC - Trigger Analysis Agent can also produce a plan and execute steps in one pass—see Getting StartedGetting Started and Operations and GuidanceOperations and Guidance. Understanding how to use each phase effectively improves investigation efficiency.
Understanding Plan Phases
Preparation Phase
- Purpose: Validate observables and confirm alert context
- When to use: First phase after generating a plan
- Typical steps:
- Enrich observables with multiple TI providers (AbuseIPDB, Recorded Future, VirusTotal)
- Get endpoint details from EDR/XDR platforms
- Validate observable types and values
- Best practice: Complete preparation before moving to analysis to ensure you have accurate context
Analysis Phase
- Purpose: Verify scope, impact, and lateral movement
- When to use: After preparation is complete
- Typical steps:
- Search SIEM/EDR for related activity
- Check for similar infections across endpoints
- Get user and asset details
- Search for network connections and data transfers
- Review web activity logs
- Best practice: Execute analysis steps systematically to build a complete picture
Determination Phase
- Purpose: Finalize the verdict based on collected evidence
- When to use: After analysis is complete
- Typical step: Generate verdict using AI SOC - CASE Hero AI Analysis
- Best practice: Review all evidence before generating the final verdict
Automation Phase
- Purpose: Create automation for repeatable signal patterns
- When to use: After resolving signals that will likely recur
- Options:
- Create a Triage Rule: Route similar signals automatically
- Create a Playbook: Automate investigation steps from the plan (or from an agentic investigation session)
- Recreate Playbook: Regenerate the associated playbook from the current investigation plan when the plan changed—see Creating AutomationCreating Automation
- Investigation playbooks: Duplicate or build in Orchestration and attach on a rule record — see Building Routing Rule PlaybooksBuilding Routing Rule Playbooks
- Best practice: Create automation for patterns you see frequently
Remediation Plan
- Purpose: Generate post-investigation remediation guidance
- When to use: After confirming a malicious verdict
- How to use: Click Generate Remediation Plan in the AI Alert Analysis panel
- Updating: When the verdict or investigation findings change, click Regenerate Remediation Plan in the same section
- Best practice: Review remediation steps before executing, especially those that modify systems
Working with Plan Steps
Before Running Steps:
- Review each step to understand what it will do
- Check if required integrations are installed
- Verify you have appropriate permissions
- Consider the impact of steps that modify systems
While Running Steps:
- Monitor step execution in the timeline
- Review results as they complete
- Add notes if steps produce unexpected results
- Document any manual actions taken outside the system
After Running Steps:
- Review all step results before making decisions
- Update investigation comments with findings
- Re-run analysis if new evidence changes the context
- Mark steps as done if completed manually
Managing Steps:
- Add Additional Step: Insert custom steps specific to your organization
- Delete Step: Remove steps that are not relevant to this investigation
- Mark as Done: Record steps completed outside the system
- Mark as Open: Reopen completed steps to run again
Plan Generation Best Practices
Before Generating:
- Ensure threat intelligence enrichment has completed
- Review evidence panels (Knowledge Base, Threat Intelligence, Correlation)
- Verify observables are present on the signal
- Check that Hero AI is enabled and available
During Generation:
- Wait for plan generation to complete (may take 30-60 seconds)
- Do not navigate away from the record during generation
- Watch progress detail messages in AI Alert Analysis while Generate Plan, Regenerate Investigation Plan, or Regenerate Remediation Plan runs. Messages update in real time (for example, reading signal details, threat intelligence, or building the plan). Up to three recent status lines may appear; plan actions are disabled until the agent finishes or you cancel.
- Check browser console if generation fails
After Generation:
- Review the plan before executing steps
- Understand what each step will do
- Identify any missing integrations
- Consider adding custom steps if needed
Updating Investigation and Remediation Plans
When an investigation plan already exists, Regenerate Investigation Plan appears in AI Alert Analysis. Use it when new evidence, updated KBAs, or signal field changes mean the current plan is incomplete or out of date.
Situation | Recommended option |
|---|---|
Threat intelligence enrichment finished after the plan was generated | Keep executed steps or Start from beginning |
New observables or correlation data changed the investigation scope | Keep executed steps if prior step results are still valid |
KBAs were updated with new investigation guidance | Start from beginning if prior steps conflict with new guidance |
You deleted or heavily edited plan steps and want a fresh AI proposal | Start from beginning |
Steps:
- Open the signal record and scroll to AI Alert Analysis.
- Click Regenerate Investigation Plan.
- Choose Keep executed steps (Hero AI rebuilds remaining and new steps; completed results stay on the record and timeline) or Start from beginning (replaces the entire plan, same process as Generate Plan).
- If you chose Keep executed steps, enter optional guidance when prompted (for example, focus on a new observable).
- Confirm your choice. Progress detail messages appear until the updated plan is shown.
- Review the regenerated plan before running new steps.
After a remediation plan exists, Regenerate Remediation Plan appears in the Remediation Plan section. Choose Confirm to proceed or Cancel to keep the current plan. Review each remediation step after regeneration, especially if the manual or AI verdict changed.
Wait for Threat Intelligence Status to show complete before generating or regenerating a plan so Hero AI has full enrichment context. See TroubleshootingTroubleshooting if generation fails or returns unexpected steps.