Investigation Plan Workflow
The Generate Investigation Plan action creates an AI-powered investigation plan organized into phases. Regeneration is never automatic: if signal context, evidence, or knowledge base guidance changes and you decide the plan is out of date, you manually click Regenerate Investigation Plan or Regenerate Remediation Plan to have Hero AI rebuild it—without starting from an empty record. The AI SOC - Trigger Analysis Agent can also produce a plan and execute steps in one pass—see Getting Started and Operations and Guidance. Understanding how to use each phase effectively improves investigation efficiency.
Understanding Plan Phases
Preparation Phase
- Purpose: Validate observables and confirm alert context
- When to use: First phase after generating a plan
- Typical steps:
- Enrich observables with multiple TI providers (AbuseIPDB, Recorded Future, VirusTotal)
- Get endpoint details from EDR/XDR platforms
- Validate observable types and values
- Best practice: Run preparation before moving to analysis to ensure you have accurate context
Analysis Phase
- Purpose: Verify scope, impact, and lateral movement
- When to use: After running preparation
- Typical steps:
- Search SIEM/EDR for related activity
- Check for similar infections across endpoints
- Get user and asset details
- Search for network connections and data transfers
- Review web activity logs
- Best practice: Execute analysis steps systematically to build a complete picture
Determination Phase
- Purpose: Finalize the verdict based on collected evidence
- When to use: After running analysis
- Typical step: Generate verdict using AI SOC - CASE Hero AI Analysis
- Best practice: Review all evidence before generating the final verdict
Automation Phase
- Purpose: Create automation for repeatable signal patterns
- When to use: After resolving signals that will likely recur
- Options:
- Create a Triage Rule: Route similar signals automatically
- Create a Playbook: Automate investigation steps from the plan (or from an agentic investigation session)
- Recreate Playbook: Regenerate the associated playbook from the current investigation plan when the plan changed—see Creating Automation
- Investigation playbooks: Duplicate or build in Orchestration and attach on a rule record — see Building Routing Rule Playbooks
- Best practice: Create automation for patterns you see frequently
Remediation Plan
- Purpose: Generate post-investigation remediation guidance
- When to use: After investigation is complete
- How to use: Click Generate Remediation Plan on the Remediation widget. The result is Recommended Remediation Plan, with Remediation Status and a step count such as 0/9 total
- Phases: Containment, Eradication, and Recovery. Each phase lists Step and Tool, plus Run All Steps and Add Additional Step
- Tools: Install means the tool is not in the tenant yet. Review and Run mean the tool is available
- Updating: Click Regenerate Remediation Plan on the same widget
- Best practice: Review remediation steps before you run them, especially steps that change systems
Working with Plan Steps
Before Running Steps:
- Review each step to understand what it will do
- Check if required integrations are installed
- Verify you have appropriate permissions
- Consider the impact of steps that modify systems
While Running Steps:
- Monitor step execution in the timeline
- Review results as they complete
- Add notes if steps produce unexpected results
- Document any manual actions taken outside the system
After Running Steps:
- Review all step results before making decisions
- Update investigation comments with findings
- Re-run analysis if new evidence changes the context
- Mark steps as done if completed manually
Managing Steps:
- Add Additional Step: Insert custom steps specific to your organization
- Delete Step: Remove steps that are not relevant to this investigation
- Mark as Done: Record steps completed outside the system. Mark as Done and Mark as Open stay hidden when executePlan is off on Investigation
- Mark as Open: Reopen completed steps to run again
Plan Generation Best Practices
Before Generating:
- Ensure threat intelligence enrichment has completed
- Review Knowledge Base, Threat Intelligence, and Correlated Cases
- Verify observables are present on the signal
- Check that Hero AI is enabled and available
During Generation:
- Wait for plan generation to complete (typically 3-4 minutes)
- Do not navigate away from the record during generation
- Watch progress detail messages on the Investigation or Remediation widget while Generate Investigation Plan, Regenerate Investigation Plan, or Regenerate Remediation Plan runs. Messages update in real time (for example, reading signal details, threat intelligence, or building the plan). Up to three recent status lines may appear; plan actions are disabled until the agent finishes or you cancel.
- Check browser console if generation fails
After Generation:
- Review the plan before executing steps
- Understand what each step will do
- Identify any missing integrations
- Consider adding custom steps if needed
Updating Investigation and Remediation Plans
When an investigation plan already exists, Regenerate Investigation Plan appears on the Investigation widget. Use it when new evidence, updated KBAs, or signal field changes mean the current plan is incomplete or out of date.
Situation | Recommended option |
|---|---|
Threat intelligence enrichment finished after the plan was generated | Keep executed steps or Start from beginning |
New observables or correlation data changed the investigation scope | Keep executed steps if prior step results are still valid |
KBAs were updated with new investigation guidance | Start from beginning if prior steps conflict with new guidance |
You deleted or heavily edited plan steps and want a fresh AI proposal | Start from beginning |
Steps:
- Open the signal record and open Case Investigation → Investigation.
- Click Regenerate Investigation Plan.
- Choose Keep executed steps (Hero AI rebuilds remaining and new steps; completed results stay on the record and timeline) or Start from beginning (replaces the entire plan, same process as Generate Investigation Plan).
- If you chose Keep executed steps, enter optional guidance when prompted (for example, focus on a new observable).
- Confirm your choice. Progress detail messages appear until the updated plan is shown.
- Review the regenerated plan before running new steps.
After a remediation plan exists, Regenerate Remediation Plan appears in the Remediation Plan section. Choose Confirm to proceed or Cancel to keep the current plan. Review each remediation step after regeneration, especially if the manual or AI verdict changed.
Wait for Threat Intelligence Status to show complete before generating or regenerating a plan so Hero AI has full enrichment context. See Troubleshooting if generation fails or returns unexpected steps.