Security Alert Investigation Desk

How the workflow runs

1. 1Validate the alert, preserve raw artifacts, and identify duplicates or common incident scope.
2. 2Build an entity and event timeline across identity, host, network, cloud, and message evidence.
3. 3Map observed behavior to ATT&CK only when telemetry supports the mapping.
4. 4Test benign and malicious hypotheses and grade confidence separately from severity.
5. 5Propose containment and evidence-preservation actions with approval gates and rollback consequences.
6. 6Publish a replayable investigation ledger, escalation decision, and detection-improvement backlog.

Example usage

Start with one of these requests, then replace the details with your own.