Alert investigation
The agent works through an alert the way an analyst would: what raised it, which machine and person it touches, what else happened nearby and what is known about the places it connected to. It ends with a verdict your team can check.
Each one needs a search in a different tool, and the answers have to be put together before a person can say what happened.
The SIEM, the endpoint console, the asset list and threat intelligence each hold part of the answer, behind a different search.
Knowing which question to ask next comes with years of practice, and the people who have it are the hardest to hire.
An investigation that lives in one person’s searches cannot be reviewed, repeated or handed over.
A machine name says little. What matters is what the machine does for the company, and that is rarely in the alert.
The map of a real investigation from our lab, drawn as the agent worked: every source it read, every question it asked, and the path that backs the verdict.
Each investigation ends in a plain verdict and how sure the agent is, with a short account of what happened in words a manager can read. In our lab, it found a hidden adversary-simulation agent beaconing every five minutes and called it a real attack at 90% confidence.
The investigation map lays the work out in columns: the alert, the machine and accounts in it, the data sources the agent read, each question it asked, the verdict and the next steps. The path that backs the verdict is drawn in red, so you can follow it from the alert to the conclusion.
Every record the agent collected is kept, numbered and cited in the sentence that relies on it. A reviewer can open the log line, lookup or event behind any claim, beside what the machine does for your business.
A person reads the result, then agrees with it or changes it. What they say is remembered for the next investigation about your company, so the agent learns your normal.
It recommends what to do next, such as checking other machines for the same activity or keeping the logs. Your people decide and act; armor360 does not.
Lab results, not customer data: one of our deepest investigations, of an adversary-simulation agent on a Linux machine. Across all our lab runs the median is 76 s.
The agent reads the rule that fired, the triggering event, the machine, the account and the time, and works out which questions need answering first.
Each question becomes a search or a lookup: events in the SIEM, the process chain, other alerts on the host, user activity and threat intelligence on any indicators.
Each record it reads is kept and numbered. An answer can raise a new question, and the agent stops when the evidence is enough to make a call.
A person gets the verdict, the confidence, a plain account and recommended next steps, with each claim cited. They review it, then decide and act themselves.
Searches the SIEM for what the machine and account did before and after the alert.
Follows parent and child processes to see what started what.
Reads the machine’s recent alerts to see whether this one is part of something larger.
Looks up addresses, domains, hashes and names in MISP, VirusTotal, AlienVault OTX and AbuseIPDB.
Asset details, who uses the machine and what it runs for the business.
Corrections and context your team gave on earlier alerts about your company.
It starts from the alert: the rule that fired, the machine, the account and the time. From there it asks itself questions an analyst would ask, such as what else ran on the machine, what started the process and whether an address is known to be bad, and answers each with a search or lookup.
Each answer can raise the next question. When the evidence is enough, it writes the verdict. In our lab investigation it asked 13 questions and kept 22 records as evidence.
You do not have to take it on trust. Every claim in the verdict cites the record behind it, and the map shows every question the agent asked, including the ones that found nothing. A person reviews the verdict before anything happens.
The agent also says how sure it is, and says so plainly when the evidence is not enough.
The agent recommends next steps, for example reviewing other machines for the same activity or keeping the logs from the affected one. Urgent findings reach the people you chose, by chat, paging or email. Your team decides what to do and does it with its own tools; armor360 takes no action on your systems.
armor360 investigates using the data you already have. With Elastic Security, the agent searches your logs during an investigation, where they already live. Splunk, Microsoft Sentinel, CrowdStrike Falcon and Microsoft Defender send their alerts in, and the agent works from those alerts, threat intelligence and the business context you gave it. Nothing has to be moved or copied into a new store first.
Start a free pilot on your own alerts, or put in your own numbers first.
