Ask the LLM about this case
Query Translator natural language → VQL / KQL / ES|QL / SPL / Sigma / YARA / Suricata
Executive Summary
Recommended Next Steps
Attack Path
Narrative Timeline
📌 Pinned Findingsthe analyst-curated shortlist — pin a finding with 📌, drag to reorder, click to jump
Findings
Forensic Timeline
Kill Chainevents bucketed by their ATT&CK tactic (derived, no AI); a categorization, not a confirmed kill-chain stage — e.g. valid-account use can span entry and lateral movement
Attack Phasestemporal bursts — activity grouped by time gap, labelled by dominant tactic (derived, no AI)
Host & Account Rankingwhich hosts/accounts carry the attack — scored by signal (severity-weighted events + techniques + connective IOCs), not volume (derived, no AI)
Timeline Gapssuspicious silent periods — a complete gap (all sources dark) is the classic log-tampering signature (derived, no AI); a lead, not proof
Timeline Swimlanevisual chart — Y-axis: assets · X-axis: time · color: severity (derived, no AI)
Compromised Assets & IoC Graph
Known compromised assets
Evidence Chaincausal links — process trees, lateral movement, file lineage & network flows (derived, no AI)
Beacon Candidatesperiodic outbound channels — too regular to be human traffic (derived, no AI); a hunting lead, not a verdict
Timeline Anomaliesassets whose event rate in a time bucket spikes — vs other assets (peer) or vs their own baseline (self) (derived, no AI); a triage lead, not a verdict
🌍 Geographic Mapimported IPs geolocated from GeoIP enrichment — markers colored by severity (derived; OpenStreetMap tiles load on demand when you open the map)
IOCs
Customer Exposure
Key Investigative Questions
Hunting ProfileWhat has been hunted in this case and whether it found anything
Investigation Threads
MITRE ATT&CK
Adversary Hintsknown ATT&CK groups by technique overlap + their likely next techniques — hypothesis fuel, not attribution (derived, no AI)
Mitigation & Defensive Countermeasuresconcrete MITRE ATT&CK mitigations to apply for this incident's techniques, plus D3FEND defensive techniques — offline, no AI
Suggested Fleet HuntsAI-proposed Velociraptor VQL hunts from the findings — sweep the fleet for the same tradecraft
False Positives (excluded from analysis)
Playbook
Actionable checklist auto-derived from the recommended next steps and Critical/High findings, re-synced on each synthesis — your status, assignee, due date, and custom tasks are always preserved. Survives synthesis; included in the report.
Hypotheses
Testable explanations for the observed activity — track each from open to supported / refuted / unknown. Auto-generated whenever synthesis runs (after each import; badged auto) and analyst-authored; both survive synthesis and are never wiped. A hypothesis is a lead to test, not a verdict.
Super-Timeline
The complete record of every event ever imported (from any source — Velociraptor, firewall, VPN, host triage, anything), before scope/legitimate filtering. Filter by time, origin, and tag; star / comment / tag rows for triage; then promote the events that matter up into the analyzed forensic timeline (where the AI synthesizes them). Nothing here is removed — this is a superset view.
Analyst Notebook
Free-form notes and open questions. Entries survive synthesis and are never wiped. Optionally included in AI synthesis context (opt-in below). Got a testable claim? Use → Hypothesis to track it in the Hypotheses panel above.
Investigation Log
Case Details (for the generated report)
Human-authored sections of the incident report (AnttiKurittu template). Saved per case and merged into report.md when you click Generate Report. Leave a field blank to use the auto-derived value or a "to be completed" placeholder.
Threat-intel enrichment — choose sources
Pick which sources to query for this case's IOCs (hashes / IPs / domains / URLs). Local = your own self-hosted instances — queries stay on-box (OPSEC-safe). External = third-party services — querying them sends the indicator off-box and can tip off an adversary, so they're off by default. Enabling a source re-checks every IOC on it.