| name | security-investigation |
| description | Drive a security investigation from a lead or hypothesis to an evidence-backed conclusion — correlate telemetry across sources, enrich with intel, reconstruct a timeline, scope impact, and reach a defensible verdict. Use for a deeper analytical investigation (beyond single-alert triage), e.g. an escalated or complex case. |
Goal
A coherent answer to "what actually happened, how far did it go, and what does it
mean" — built from correlated evidence, with a clear verdict, scope, and recommended
action.
How this differs from neighbors
- Alert triage (
soc-siem:alert-triage) — a verdict on one alert, fast and
repeatable. Escalates into an investigation.
- Investigation (this) — pulls many threads (multiple alerts, logs, intel,
hosts, accounts) into one analytic picture.
- Incident response (
dfir:incident-response) — the response action once an
investigation confirms an incident. Hand off to it.
Steps
- Frame the question — the lead/hypothesis and what a conclusion would look like
(confirmed malicious? scope? root cause?). Investigations are hypothesis-driven.
- Collect & correlate — gather relevant telemetry (EDR, auth, network, app,
SIEM) across the time window; correlate by entity (host, user, process, IP) into a
single picture. Baseline normal to separate signal from noise.
- Enrich — add intel context (
threat-intelligence:ioc-enrichment,
threat-actor-profiling) and asset/user criticality; reconcile aliases.
- Reconstruct the timeline — normalize timestamps (UTC); order attacker/entity
actions into a chronology (lean on
dfir:forensic-triage for host/forensic depth).
- Scope — pivot to find all affected entities, lateral movement, and dwell time;
map observed behavior to MITRE ATT&CK.
- Assess & conclude — verdict (confirmed/suspected/benign), confidence,
impact/scope, root cause, and intelligence gaps. Separate fact from assessment.
- Act — escalate to
dfir:incident-response if confirmed; turn findings into
detections (detection-engineering); document either way.
Output
An investigation report: question · evidence (correlated, with sources) · timeline ·
ATT&CK mapping · scope/impact · verdict + confidence · root cause · recommended
actions. Visualize timeline/link analysis with security-diagramming; write up with
security-reporting.
Notes
Correlation is the core skill — a single source rarely tells the truth; pivot across
entities and baseline normal before concluding. State confidence and separate fact
from assessment from assumption. Know when to stop analyzing and escalate: once
it's a confirmed incident, IR owns the response.
