AI Incident investigation

AI Incident investigation

The incident overview gives SOC analysts a unified view of a complex cyberattack. It combines an AI-generated brief, key evidence, affected entities, risk indicators, and pending response actions with a proportional storyline that pairs each attack stage with its defensive outcome, helping analysts quickly understand what happened, where controls failed, and what requires action next.

The contextual side drawer lets analysts investigate each attack stage without losing their place in the incident storyline. It brings together the stage overview, related alerts, supporting evidence, affected entities, MITRE ATT&CK mapping, and defensive outcome, while providing quick navigation between adjacent stages.

The investigation map visualizes how files, endpoints, processes, identities, external infrastructure, and security controls connect across the incident. By distinguishing confirmed from inferred relationships, it helps analysts trace the attack from its likely root cause to the blocked exfiltration attempt, understand its scope, and identify where further investigation or response is needed.

All Activity provides a detailed chronological view of the events and signals behind the incident story. Analysts can filter activity by source, entity, and severity, inspect each event’s relationship to the attack stages, and expand grouped signals when deeper investigation is required.

‍