investigation-creation

Create investigations by feeding security events or LCQL queries to build holistic Investigation Hive records. The skill captures initial access, host context, lateral movement, and organizational scope, then documents findings, events, detections, and analyst notes for complete SOC reporting.

Alert triage responds to individual detections, while holistic threat hunting investigations connect events across endpoints to reveal lateral movement and organizational scope. This skill builds the latter by enforcing structured data collection with mandatory documentation of host context, entities, and analyst notes.

Yes. Use the generate_lcql_query function to create LCQL queries that feed investigation creation. The skill handles timestamp calculations and absolute time window logic, then outputs results as Investigation Hive records with full event and detection context.

The skill enforces mandatory tool documentation review, requires generate_lcql_query for all LCQL operations, enforces correct timestamp handling and absolute time window calculations, and mandates output to Investigation Hive records with events, detections, entities, and analyst notes.

The skill captures lateral movement as part of holistic investigations by collecting host context and organizational-scope data across endpoints. Document findings in Investigation Hive records alongside initial access points, events, detections, and analyst notes to produce complete incident response narratives.

Yes. The skill supports alert triage by converting individual detections into Investigation Hive records with holistic context including host data, lateral movement patterns, and organizational scope, making it ideal for SOC reporting and incident response documentation.