Threat Detection, Investigation, and Response (TDIR), Timelines, and AI Agent Workflows
What this domain tests
The detection-to-closure loop: how alerts are generated, how an analyst reconstructs what happened using timelines, how response is executed and recorded, and where AI assistance and AI-agent workflows fit without weakening evidence.
Detection and triage
- Alerts come from correlation rules (multi-event logic), behavioral anomalies that cross a risk threshold, and threat-intelligence matches.
- Triage sorts on risk score, asset criticality and entity sensitivity. Related alerts should be grouped into one case rather than worked separately.
Timelines as the investigation backbone
A timeline reconstructs one entity's activity across all ingested sources in time order, with each event annotated by its anomaly score and linked entities (user ↔ host ↔ IP). This is how you answer "what did this account do before and after the alert". Pivot from the timeline into raw search to validate the underlying event before drawing conclusions.
Response and record keeping
Containment (session revocation, account disable, host isolation, IP block), notification and ticketing are executed through automation or manually, and every action is written back to the case. A case without a recorded decision and evidence is not closed work.
AI assistance and AI-agent workflows
The platform's generative assistant is useful for natural-language search, alert summarization and suggested next steps. AI-agent workflows chain those steps - enrich, summarize, propose containment, escalate - but high-impact actions require human approval, and every agent action must land in the audit trail with the evidence it relied on. Treat an AI summary as a pointer to events, never as the evidence itself.
Worked example
An identity-provider alert fires for a login from a new country. The timeline shows the new-country login, a burst of MFA push prompts, then an OAuth consent grant to an unfamiliar application, with risk climbing across the session. Reasoning: the sequence, not the single login, indicates consent-phishing. Response: revoke sessions, remove the grant, reset credentials, and hunt other users targeted by the same application.
Traps
- Closing on the AI summary without opening the cited events.
- Investigating one alert in isolation when the timeline shows a linked sequence.
- Auto-containment with no approval path or audit record.
- Empty timelines caused by unparsed or unnormalized sources, misread as "no activity".