full-investigation

You can orchestrate end-to-end Tier 2/3 security investigations by initiating the workflow with a CASE_ID and optional PRIMARY_IOCS. It automatically coordinates intake, routing, IOC analysis, triage, and reporting to streamline resolution.

Automating triage and reporting for escalated incident response cases is achieved through dynamic routing based on alert type. The workflow enforces required steps, handles correlation, and generates a final investigation report and disposition.

Yes, you can use this workflow to correlate malware, authentication, and network alerts. It dynamically routes escalated security cases to specialized triage steps and expands the analysis before documentation.

This investigation orchestration integrates directly with GTI, SIEM, and IR workflows. It ensures comprehensive documentation and seamless handoff for incident response when escalation is needed.

To start an investigation run for IOC deep-dives, provide a CASE_ID and optionally PRIMARY_IOCS. This initiates the orchestration, enforcing required steps for intake, correlation, and final reporting.