full-investigation

name	full-investigation
description	Complete Tier 2 investigation workflow. Orchestrates deep investigation of escalated cases: deep-dive-ioc, correlate-ioc, specialized triage (malware/login), pivot-on-ioc, and generate comprehensive report. Use for escalated cases requiring thorough analysis. Use when this capability is needed.

Full Investigation Workflow

A composite skill that orchestrates comprehensive Tier 2/3 investigation of escalated security cases.

Inputs

• CASE_ID - The escalated case to investigate (required)
• PRIMARY_IOCS - Key IOCs identified during Tier 1 triage (optional)
• ALERT_TYPE - Type of alert (malware, authentication, network, etc.)
• ESCALATION_REASON - Why this was escalated from Tier 1

Orchestrated Workflow

┌─────────────────────────────────────────────────────────────────┐
│                   FULL INVESTIGATION                            │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ESCALATED CASE                                                 │
│       │                                                         │
│       ▼                                                         │
│  ┌─────────────────────┐                                        │
│  │   /deep-dive-ioc    │  (for each primary IOC)                │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│             ▼                                                   │
│  ┌─────────────────────┐                                        │
│  │   /correlate-ioc    │                                        │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│     ┌───────┴───────────────────┐                               │
│     │     ALERT TYPE ROUTING    │                               │
│     └───────────────────────────┘                               │
│             │                                                   │
│   ┌─────────┼───────────┬─────────┐                             │
│   ▼         ▼           ▼         ▼                             │
│ MALWARE   AUTH      NETWORK    OTHER                            │
│   │         │           │         │                             │
│   ▼         ▼           ▼         ▼                             │
│ /triage   /triage      /pivot   Continue                        │
│ -malware  -suspicious  -on-ioc  with pivoting                   │
│   │       -login        │         │                             │
│   └─────────┴───────────┴─────────┘                             │
│             │                                                   │
│             ▼                                                   │
│  ┌─────────────────────┐                                        │
│  │   /pivot-on-ioc     │  (expand investigation)                │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│     ┌───────┴───────┐                                           │
│     │   DECISION    │                                           │
│     └───────┬───────┘                                           │
│             │                                                   │
│   ┌─────────┼─────────┐                                         │
│   ▼         ▼         ▼                                         │
│ INCIDENT  RESOLVED  ESCALATE                                    │
│   │         │       TO IR                                       │
│   ▼         ▼         │                                         │
│ Create   /close       │                                         │
│ Incident  -case       │                                         │
│   │       -artifact   │                                         │
│   │         │         │                                         │
│   └─────────┴─────────┘                                         │
│             │                                                   │
│             ▼                                                   │
│  ┌─────────────────────┐                                        │
│  │  /generate-report   │                                        │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│             ▼                                                   │
│            END                                                  │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Detailed Steps

Phase 1: Deep Analysis

Step 1.0: Extract Primary IOCs (if not provided)

If PRIMARY_IOCS is not provided as input, extract key entities from the case:

secops-soar.get_case_full_details(case_id=CASE_ID)

From the case details, extract IOCs:

• IP addresses from alert entities
• Domain names from network indicators
• File hashes from endpoint alerts
• URLs from web security alerts

Populate PRIMARY_IOCS with extracted IOCs.

Step 1.1: Deep Dive on Primary IOCs

For each IOC in PRIMARY_IOCS:

Invoke: /deep-dive-ioc IOC_VALUE=$ioc CASE_ID=$CASE_ID

Collect:

• GTI_DEEP_FINDINGS - Full threat intelligence analysis
• SIEM_DEEP_CONTEXT - Detailed SIEM context
• RELATED_ENTITIES - Discovered related IOCs and entities
• THREAT_ATTRIBUTION - Any threat actor/campaign links

Step 1.2: Aggregate Discovered IOCs

Combine all RELATED_ENTITIES collected from deep-dive steps into ALL_DISCOVERED_IOCS:

ALL_DISCOVERED_IOCS = PRIMARY_IOCS + all(RELATED_ENTITIES from each deep-dive)

This aggregated list is used for correlation in Phase 2.

Phase 2: Correlation

Step 2.1: Correlate with Existing Cases

Invoke: /correlate-ioc IOC_LIST=$ALL_DISCOVERED_IOCS

Collect:

• RELATED_CASES - Other cases with same IOCs
• RELATED_ALERTS - Alerts involving same entities
• PATTERN_ANALYSIS - Detected patterns across cases

Step 2.2: Find Related Open Cases

Invoke: /find-relevant-case with key entities

Document any linked investigations.

Phase 3: Specialized Analysis

Step 3.1: Route by Alert Type

Based on ALERT_TYPE, invoke specialized triage:

Alert Type	Skill	Focus
Malware	/triage-malware	File analysis, behavior, persistence
Authentication	/triage-suspicious-login	User activity, login patterns
Network	/pivot-on-ioc	Network IOC relationships
Other	Continue to pivoting	General IOC expansion

For Malware: Invoke: /triage-malware FILE_HASH=$hash CASE_ID=$CASE_ID

Collect:

• Malware family identification
• Behavioral analysis
• Affected systems
• Containment recommendations

For Authentication: Invoke: /triage-suspicious-login USER=$user CASE_ID=$CASE_ID

Collect:

• Login anomaly analysis
• User activity timeline
• Compromised account indicators
• Account status recommendations

Phase 4: Expansion

Step 4.1: Pivot on High-Confidence IOCs

For each high-confidence malicious IOC:

Invoke: /pivot-on-ioc IOC_VALUE=$ioc

Collect:

• RELATED_INFRASTRUCTURE - Connected domains, IPs, files
• CAMPAIGN_LINKS - Associated campaigns or actors
• ADDITIONAL_IOCS - New IOCs to hunt for

Step 4.2: Validate Expanded IOCs

For significant new IOCs discovered:

• Quick GTI lookup
• SIEM presence check
• Add to investigation scope if relevant

Phase 5: Assessment

Step 5.1: Determine Investigation Outcome

Assess all findings and classify:

Outcome	Criteria	Action
Incident Confirmed	Active compromise, ongoing threat	Escalate to IR
Resolved - Contained	Threat neutralized, no ongoing risk	Document & Close
Resolved - False Positive	Deep analysis confirms benign	Document & Close
Requires IR Escalation	Containment/eradication needed	Escalate to IR

Step 5.2: Execute Disposition

If Incident Confirmed / Requires IR:

1. Invoke: /document-in-case with full findings
2. Output escalation recommendation:
   • Recommend specific IR skill:
     • Ransomware indicators → /respond-ransomware
     • Malware persistence → /respond-malware
     • Phishing origin → /respond-phishing
     • Account compromise → /respond-compromised-account
3. Prepare handoff package for IR team

If Resolved:

1. Invoke: /document-in-case with:
   • Investigation summary
   • All queries and findings
   • Resolution rationale
2. If closing: Invoke: /close-case-artifact with appropriate reason

Phase 6: Documentation

Step 6.1: Generate Investigation Report

Invoke: /generate-report REPORT_TYPE=investigation

Include:

• Executive summary
• Investigation timeline
• All IOCs analyzed (with verdicts)
• SIEM queries used
• GTI findings
• Correlation results
• Attack chain (if identified)
• Recommendations
• Lessons learned

Outputs

Output	Description
INVESTIGATION_OUTCOME	Incident, Resolved, or Escalated
THREAT_ASSESSMENT	Severity, scope, and attribution
ALL_IOCS	Complete list of analyzed IOCs with verdicts
ATTACK_CHAIN	Reconstructed attack timeline (if applicable)
REPORT_PATH	Path to investigation report
ESCALATION_DETAILS	If escalated, target and handoff package

Error Handling

• If /deep-dive-ioc fails → Fall back to /enrich-ioc, continue
• If GTI Enterprise features unavailable → Document limitation, use Standard features
• If specialized triage fails → Document, continue with general analysis
• If correlation timeout → Proceed with available data, note gap

Performance Targets

• Total workflow time: < 2 hours
• Deep dive per IOC: < 15 minutes
• Correlation: < 10 minutes
• Specialized triage: < 30 minutes
• Report generation: < 15 minutes
• Target accuracy: > 95% correct assessment

---

Source: dandye/ai-runbooks — distributed by TomeVault.