secops-investigate

To conduct a security investigation, initiate the process by providing a case ID or entity. The system guides you through step-by-step procedures for malware analysis, remote tool selection, evidence gathering, and formal reporting.

Incident response case closure requires synthesizing enriched data and documenting findings. The procedure specifies generating formal investigation reports and creating SOAR entries to ensure all evidence and case correlations are officially recorded.

Choosing between remote tools and local data sources during forensics relies on reference mappings. The system provides tool-agnostic guidance to select appropriate access methods for evidence gathering and case correlation.

Yes, you can use this for investigating lateral movement within a SOC environment. It provides step-by-step investigation procedures for common security scenarios including lateral movement, malware, and case management.

To document and report findings from an incident response investigation, follow the built-in documentation guidelines. These specify how to generate SOAR entries and compile formal investigation reports based on synthesized evidence.

To start an expert-guided security investigation, you need a specific case ID or entity to investigate. The system then applies standard procedures for enrichment, synthesis, and documentation based on your initial input.