Automatic investigation

How does it work?

The Automatic Investigation process relies on the availability of data from multiple data sources. This presents a challenge since some data might not be available when the lead is generated. Furthermore, some advanced Automatic Investigation logic provided out-of-the-box looks for information that explicitly happens after the original event.


For instance, when a potentially malicious process is detected, Hunters collects data on the actions taken by the process after its initial execution. Looking for clues such as dropped suspicious files or network connections that may suggest the presence of a backdoor or exfiltration activity.


To speed up the investigation process, we have split the Automatic Investigation process into two phases:

• Rapid Automatic Investigation - This initial investigation for rapid attack scoping takes only a few minutes to complete and provides analysts with a basic framework and details of the possible threat.
• Advanced Automatic Investigation - On top of the initial basic layer of information, Hunters provides a deep analysis of the threat evolution inside the organization that does not exist at the time of detection, such as the execution tree of a suspicious process, network connections, or compromised user behavior. This layer takes up to an hour to complete as it requires following up on the progression of the threat, and connecting both layers of information together to provide the full picture.
  
  
  

By separating the process into phases, the system is able to provide first data points about the possible threat within minutes, allowing analysts to perform an initial inquiry into the threat while the system continues to enrich this entity with data from across your attack surface to provide greater context and understanding.


With the newly released Rapid Automatic Investigation step in the full investigation process, we will further support smart prioritization of alerts and incidents, and continue reducing the redundant manual work in the triage and investigation phases.

In the initial phase of lead creation, the lead is simply a collection of attributes and their values.

In the second phase of the lead creation process, the automatic investigation process kicks in. The investigation phase is responsible for the curation and prioritization of the threat signals. It extracts the entities involved in the lead, enriches those entities with additional information from many different data sources, and then generates automatic risk scoring and prioritization based on deep analysis of the lead and its entities.


This is what a lead looks like after the automatic investigation process.

The lead summary page contains the main entities involved in the lead, and the final risk score assigned for this lead. We can also see the different scoring models that contributed to the final risk score.

Below we can see a specific entity that was created during the automatic investigation process. Some of the entity's attributes (like the IP address) came from the original lead, while some were enriched from external sources.
For example, the lead's geographical context came from a global IP info datasource, and the IP was also searched in Azure AD activity, in order to provide additional context about the signal - was the IP seen interacting only with AWS, or also with other organizational applications?