Investigate alerts with AI, respond with confidence

A built-in AI agent that works like your best analyst

When you initiate the Alert Investigation Agent on any alert, the agent uses LLM-driven reasoning to determine which actions to take based on the alert type and available data. It works through a defined set of investigation steps, with the sequence and depth tailored to each alert.

• Entity identification and data enrichment: The agent extracts all entities from the alert: users, IP addresses, domains, hosts, processes, and files. It then queries VirusTotal, Log360's integrated Advanced Threat Analytics, and user and entity behavior analytics (UEBA) to assess each entity's risk level.
• Related alert and log analysis: The agent searches for other alerts linked to the same entities, finding recurring patterns or coordinated activity across alert types. When alert data alone isn't enough, it queries log data using targeted searches to find additional events of interest.
• Timeline construction and suggestions: Related findings are arranged chronologically to show how the attack played out. The agent then presents suggested immediate actions and future risks of the identified threat.
• Investigation report: The agent creates a detailed report of the investigation trail that can be exported as a PDF and added to an existing or new incident as evidence.
• Human in the loop: At key decision points, the agent pauses for user input. Users can select from the given options, and also manually enter queries in natural language to guide the investigation.

AI-driven reasoning, analyst-guided control

• Pause and resume: Pause the investigation at any point. When you resume, the agent picks up from exactly where it stopped.
• Redirect the investigation: After pausing, you can choose to continue analysis with a different entity or alert profile. The agent provides suggestions, or you can enter one manually. Use the Ask Zia text box to ask follow-up questions about specific entities or processes within the same investigation context.
• Extend the search window: If no relevant alerts or logs are found in the initial time range, the agent offers to extend the search to previous days.

Everything you need to act in one report

• Investigation report The completed investigation includes a summary of findings, a chronological attack chain mapped to MITRE ATT&CK techniques, affected entities, recommended remediation actions, and the supporting event evidence.
• Export as PDF: Download the complete investigation report for offline review, sharing with stakeholders, or compliance documentation.
• Add to incident: Link the investigation to an existing incident or create a new one directly from the investigation window. The investigation details are attached as evidence to the Incident.