Now triage decision cockpit
Ask the LLM about this case
Query Translator natural language → VQL / KQL / ES|QL / SPL / Sigma / YARA / Suricata
Executive Summary
Recommended Next Steps
Collection Planthe evidence this incident type calls for, in order — ticked off from what the case already holds (derived, no AI)
Scope & Clearancewhat is affected, what was never collected, and what an analyst has cleared — clearance means no evidence of compromise was found given the sources collected, not that a host is clean (derived, no AI)
Duplicate Hostshosts seen under more than one name — analysis is on hold until each pair is confirmed as one machine or two (derived, no AI)
Attack Path
Narrative Timeline
Findings
Deep Pass
Normal synthesis shows the model one prompt's worth of events, and prompt rows scale with the number of hosts — so on a multi-host case most graded detections are never read. A deep pass reads every graded event at or above the floor you choose, in as many batches as it takes, and folds the result into one final synthesis that replaces the current conclusions. Pick the floor against the real numbers below: there is no default that is right for every case. The pre-flight costs nothing; the run is slow and expensive, and can be cancelled.
Attacker Sessionsthe timeline re-threaded as per-host chapters — a contiguous run on one host with no long gap inside it (derived, no AI); click a card to filter the timeline to that session
Forensic Timeline
Kill Chainevents bucketed by their ATT&CK tactic (derived, no AI); a categorization, not a confirmed kill-chain stage — e.g. valid-account use can span entry and lateral movement
Memory Next Stepsiterative memory-forensics agent — reads the imported Volatility/Rekall evidence, spots process-tree/injection/network anomalies, and suggests the exact next Volatility command
Attack Phasestemporal bursts — activity grouped by time gap, labelled by dominant tactic (derived, no AI)
Host & Account Rankingwhich hosts/accounts carry the attack — scored by signal (severity-weighted events + techniques + connective IOCs), not volume (derived, no AI)
Evidence Gapswhat this case is MISSING — uncovered kill-chain phases (with where to collect), silent windows, and lookalike-actor next moves (derived, no AI); a lead, not proof
Timeline Gapssuspicious silent periods — a complete gap (all sources dark) is the classic log-tampering signature (derived, no AI); a lead, not proof
Timeline Swimlanevisual chart — Y-axis: assets · X-axis: time · color: severity (derived, no AI)
Compromised Assets & IoC Graphassets and IOCs derived from findings and the timeline, plus any you add by hand — edges show how they connect
Known compromised assets
Evidence Chaincausal links — process trees, lateral movement, file lineage & network flows (derived, no AI)
Lateral movement paths — ordered entry → pivot → target chains reconstructed from lateral_move + ran_on evidence, by real timestamp (#92)
Beacon Candidatesperiodic outbound channels — too regular to be human traffic (derived, no AI); a hunting lead, not a verdict
Timeline Anomaliesassets whose event rate in a time bucket spikes — vs other assets (peer) or vs their own baseline (self) (derived, no AI); a triage lead, not a verdict
🔑 Login Graphwho logged on where — accounts → hosts from super-timeline logon events (4624/4625)
🌍 Geographic Mapimported IPs geolocated from GeoIP enrichment — markers colored by severity (derived; OpenStreetMap tiles load on demand when you open the map)
IOCs
Customer Exposure
Key Investigative Questionsopen questions the AI is tracking — answered automatically once the evidence supports them
Uncertainty Ledgerwhat the analysis KNOWS vs INFERRED vs SPECULATED — treat anything below Confirmed as provisional, not fact
Hunting ProfileWhat has been hunted in this case and whether it found anything
Investigation Threadsopen leads the AI tracks across re-synthesis runs — closed automatically once the evidence resolves them
MITRE ATT&CK
Adversary Hintsknown ATT&CK groups by technique overlap + their likely next techniques — hypothesis fuel, not attribution (derived, no AI)
Playbook Matchdid this case's techniques happen in the ORDER a published ransomware playbook describes — matches the playbook, not the actor (derived, no AI)
Mitigation & Defensive Countermeasuresconcrete MITRE ATT&CK mitigations to apply for this incident's techniques, plus D3FEND defensive techniques — offline, no AI
Compliance Impactcontrol failures & regulatory obligations for this case's CONFIRMED findings — offline, no AI, not legal advice
Suggested Fleet HuntsAI-proposed Velociraptor VQL hunts from the findings — sweep the fleet for the same tradecraft
False Positives (excluded from analysis)
Learned patterns — recurring dismissals fed to synthesis: new look-alikes are surfaced at lower confidence unless corroborated (not excluded)
Source Trust how much each tool's evidence is weighted — steers which tool's wording wins a cross-source merge and caps confidence for low-trust-only findings (#66)
Override a source's trust (0–1) for THIS case — e.g. a hunt that was noisy on this engagement. Blank = use the built-in default. Applies on the next synthesis.
Playbook
Actionable checklist auto-derived from the recommended next steps and Critical/High findings, re-synced on each synthesis — your status, assignee, due date, and custom tasks are always preserved. Survives synthesis; included in the report.
Hypotheses
Testable explanations for the observed activity — track each from open to supported / refuted / unknown. Auto-generated whenever synthesis runs (after each import; badged auto) and analyst-authored; both survive synthesis and are never wiped. A hypothesis is a lead to test, not a verdict.
Hunt Workbench typed field queries over an explicitly selected timeline — indexed, cursor-paged and resource-bounded
event.category=authentication AND event.outcome=failed | group by source.ip | count | sort count descGrammar reference
Open a case to load the typed grammar and field catalogue.
Super-Timeline
The complete record of every event ever imported (from any source — Velociraptor, firewall, VPN, host triage, anything), before scope/legitimate filtering. Filter by time, origin, and tag; star / comment / tag rows for triage; then promote the events that matter up into the analyzed forensic timeline (where the AI synthesizes them). Nothing here is removed — this is a superset view.
Analyst Notebook
Free-form notes and open questions. Entries survive synthesis and are never wiped. Optionally included in AI synthesis context (opt-in below). Got a testable claim? Use → Hypothesis to track it in the Hypotheses panel above.
Investigation Logimport events and AI notes merged with analyst quick-action entries, in chronological order
Activity LogEvery security-relevant action taken on this case
MCP Analysisdescribe the investigation in plain English and let your MCP app choose the tools — results import into the case and evidence transfer is written to the chain of custody
Advanced: call one MCP tool manually
Imported analysis history
Chain of Custodyevery stored artifact, its hash, and each event that touched it — the appendix that ships in the report
Case Details (for the generated report)
Human-authored sections of the incident report (AnttiKurittu template). Saved per case and merged into report.md when you click Generate Report. Leave a field blank to use the auto-derived value or a "to be completed" placeholder.
Threat-intel enrichment — choose sources
Pick which sources to query for this case's IOCs (hashes / IPs / domains / URLs). Local = your own self-hosted instances — queries stay on-box (OPSEC-safe). External = third-party services — querying them sends the indicator off-box and can tip off an adversary, so they're off by default. Enabling a source re-checks every IOC on it.