---
title: Investigation Plan Workflow
slug: solutions/investigation-plan-workflow
docTags: 
createdAt: 2026-03-04T10:52:01.559Z
---

The **Generate Plan** action creates an AI-powered investigation plan organized into phases. When signal context, evidence, or knowledge base guidance changes, **Regenerate Investigation Plan** or **Regenerate Remediation Plan** refreshes the plan without starting from an empty record. The **AI SOC - Trigger Analysis Agent** can also produce a plan and execute steps in one pass—see [Getting Started](docId\:p7QJQUayeKczHPxEpPWcp) and [Operations and Guidance](docId\:DsdGtAQeg95DSeAF2Iat-). Understanding how to use each phase effectively improves investigation efficiency.

### Understanding Plan Phases

**Preparation Phase**

- **Purpose:** Validate observables and confirm alert context
- **When to use:** First phase after generating a plan
- **Typical steps:**
  - Enrich observables with multiple TI providers (AbuseIPDB, Recorded Future, VirusTotal)
  - Get endpoint details from EDR/XDR platforms
  - Validate observable types and values
- **Best practice:** Complete preparation before moving to analysis to ensure you have accurate context

**Analysis Phase**

- **Purpose:** Verify scope, impact, and lateral movement
- **When to use:** After preparation is complete
- **Typical steps:**
  - Search SIEM/EDR for related activity
  - Check for similar infections across endpoints
  - Get user and asset details
  - Search for network connections and data transfers
  - Review web activity logs
- **Best practice:** Execute analysis steps systematically to build a complete picture

**Determination Phase**

- **Purpose:** Finalize the verdict based on collected evidence
- **When to use:** After analysis is complete
- **Typical step:** Generate verdict using **AI SOC - CASE Hero AI Analysis**
- **Best practice:** Review all evidence before generating the final verdict

**Automation Phase**

- **Purpose:** Create automation for repeatable signal patterns
- **When to use:** After resolving signals that will likely recur
- **Options:**
  - **Create a Triage Rule:** Route similar signals automatically
  - **Create a Playbook:** Automate investigation steps from the plan (or from an agentic investigation session)
  - **Recreate Playbook:** Regenerate the associated playbook from the current investigation plan when the plan changed—see [Creating Automation](docId\:wJpjTO3fjnO0JiO1DYV3S)
  - **Investigation playbooks:** Duplicate or build in **Orchestration** and attach on a rule record — see [Building Routing Rule Playbooks](docId\:vEiFYG4oYWkQ3DcMMwjXi)
- **Best practice:** Create automation for patterns you see frequently

**Remediation Plan**

- **Purpose:** Generate post-investigation remediation guidance
- **When to use:** After confirming a malicious verdict
- **How to use:** Click **Generate Remediation Plan** in the **AI Alert Analysis** panel
- **Updating:** When the verdict or investigation findings change, click **Regenerate Remediation Plan** in the same section
- **Best practice:** Review remediation steps before executing, especially those that modify systems

### Working with Plan Steps

**Before Running Steps:**

- Review each step to understand what it will do
- Check if required integrations are installed
- Verify you have appropriate permissions
- Consider the impact of steps that modify systems

**While Running Steps:**

- Monitor step execution in the timeline
- Review results as they complete
- Add notes if steps produce unexpected results
- Document any manual actions taken outside the system

**After Running Steps:**

- Review all step results before making decisions
- Update investigation comments with findings
- Re-run analysis if new evidence changes the context
- Mark steps as done if completed manually

**Managing Steps:**

- **Add Additional Step:** Insert custom steps specific to your organization
- **Delete Step:** Remove steps that are not relevant to this investigation
- **Mark as Done:** Record steps completed outside the system
- **Mark as Open:** Reopen completed steps to run again

### Plan Generation Best Practices

**Before Generating:**

- Ensure threat intelligence enrichment has completed
- Review evidence panels (Knowledge Base, Threat Intelligence, Correlation)
- Verify observables are present on the signal
- Check that Hero AI is enabled and available

**During Generation:**

- Wait for plan generation to complete (may take 30-60 seconds)
- Do not navigate away from the record during generation
- Watch **progress detail** messages in **AI Alert Analysis** while **Generate Plan**, **Regenerate Investigation Plan**, or **Regenerate Remediation Plan** runs. Messages update in real time (for example, reading signal details, threat intelligence, or building the plan). Up to three recent status lines may appear; plan actions are disabled until the agent finishes or you cancel.
- Check browser console if generation fails

**After Generation:**

- Review the plan before executing steps
- Understand what each step will do
- Identify any missing integrations
- Consider adding custom steps if needed

### Updating Investigation and Remediation Plans

When an investigation plan already exists, **Regenerate Investigation Plan** appears in **AI Alert Analysis**. Use it when new evidence, updated KBAs, or signal field changes mean the current plan is incomplete or out of date.

| Situation                                                             | Recommended option                                                 |
| --------------------------------------------------------------------- | ------------------------------------------------------------------ |
| Threat intelligence enrichment finished after the plan was generated  | **Keep executed steps** or **Start from beginning**                |
| New observables or correlation data changed the investigation scope   | **Keep executed steps** if prior step results are still valid      |
| KBAs were updated with new investigation guidance                     | **Start from beginning** if prior steps conflict with new guidance |
| You deleted or heavily edited plan steps and want a fresh AI proposal | **Start from beginning**                                           |

**Steps:**

1. Open the signal record and scroll to **AI Alert Analysis**.
2. Click **Regenerate Investigation Plan**.
3. Choose **Keep executed steps** (Hero AI rebuilds remaining and new steps; completed results stay on the record and timeline) or **Start from beginning** (replaces the entire plan, same process as **Generate Plan**).
4. If you chose **Keep executed steps**, enter optional guidance when prompted (for example, focus on a new observable).
5. Confirm your choice. **Progress detail** messages appear until the updated plan is shown.
6. Review the regenerated plan before running new steps.

After a remediation plan exists, **Regenerate Remediation Plan** appears in the **Remediation Plan** section. Choose **Confirm** to proceed or **Cancel** to keep the current plan. Review each remediation step after regeneration, especially if the manual or AI verdict changed.

:::hint{type="info"}
Wait for **Threat Intelligence Status** to show complete before generating or regenerating a plan so Hero AI has full enrichment context. See [Troubleshooting](docId\:cKnuXQV85k9lu0OCqV218) if generation fails or returns unexpected steps.
:::