full-investigation

Full Investigation Workflow

A composite skill that orchestrates comprehensive Tier 2/3 investigation of escalated security cases.

Inputs

• CASE_ID - The escalated case to investigate (required)
• PRIMARY_IOCS - Key IOCs identified during Tier 1 triage (optional)
• ALERT_TYPE - Type of alert (malware, authentication, network, etc.)
• ESCALATION_REASON - Why this was escalated from Tier 1

Orchestrated Workflow

┌─────────────────────────────────────────────────────────────────┐
│                   FULL INVESTIGATION                            │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ESCALATED CASE                                                 │
│       │                                                         │
│       ▼                                                         │
│  ┌─────────────────────┐                                        │
│  │   /deep-dive-ioc    │  (for each primary IOC)                │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│             ▼                                                   │
│  ┌─────────────────────┐                                        │
│  │   /correlate-ioc    │                                        │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│     ┌───────┴───────────────────┐                               │
│     │     ALERT TYPE ROUTING    │                               │
│     └───────────────────────────┘                               │
│             │                                                   │
│   ┌─────────┼───────────┬─────────┐                             │
│   ▼         ▼           ▼         ▼                             │
│ MALWARE   AUTH      NETWORK    OTHER                            │
│   │         │           │         │                             │
│   ▼         ▼           ▼         ▼                             │
│ /triage   /triage      /pivot   Continue                        │
│ -malware  -suspicious  -on-ioc  with pivoting                   │
│   │       -login        │         │                             │
│   └─────────┴───────────┴─────────┘                             │
│             │                                                   │
│             ▼                                                   │
│  ┌─────────────────────┐                                        │
│  │   /pivot-on-ioc     │  (expand investigation)                │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│     ┌───────┴───────┐                                           │
│     │   DECISION    │                                           │
│     └───────┬───────┘                                           │
│             │                                                   │
│   ┌─────────┼─────────┐                                         │
│   ▼         ▼         ▼                                         │
│ INCIDENT  RESOLVED  ESCALATE                                    │
│   │         │       TO IR                                       │
│   ▼         ▼         │                                         │
│ Create   /close       │                                         │
│ Incident  -case       │                                         │
│   │       -artifact   │                                         │
│   │         │         │                                         │
│   └─────────┴─────────┘                                         │
│             │                                                   │
│             ▼                                                   │
│  ┌─────────────────────┐                                        │
│  │  /generate-report   │                                        │
│  └──────────┬──────────┘                                        │
│             │                                                   │
│             ▼                                                   │
│            END                                                  │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Detailed Steps

Phase 1: Deep Analysis

Step 1.0: Extract Primary IOCs (if not provided)

If PRIMARY_IOCS is not provided as input, extract key entities from the case:

secops-soar.get_case_full_details(case_id=CASE_ID)

From the case details, extract IOCs:

• IP addresses from alert entities
• Domain names from network indicators
• File hashes from endpoint alerts
• URLs from web security alerts

Populate PRIMARY_IOCS with extracted IOCs.

Step 1.1: Deep Dive on Primary IOCs

For each IOC in PRIMARY_IOCS:

Invoke: /deep-dive-ioc IOC_VALUE=$ioc CASE_ID=$CASE_ID

Collect:

• GTI_DEEP_FINDINGS - Full threat intelligence analysis
• SIEM_DEEP_CONTEXT - Detailed SIEM context
• RELATED_ENTITIES - Discovered related IOCs and entities
• THREAT_ATTRIBUTION - Any threat actor/campaign links

Step 1.2: Aggregate Discovered IOCs

Combine all RELATED_ENTITIES collected from deep-dive steps into ALL_DISCOVERED_IOCS:

ALL_DISCOVERED_IOCS = PRIMARY_IOCS + all(RELATED_ENTITIES from each deep-dive)

This aggregated list is used for correlation in Phase 2.

Phase 2: Correlation

Step 2.1: Correlate with Existing Cases

Invoke: /correlate-ioc IOC_LIST=$ALL_DISCOVERED_IOCS

Collect:

• RELATED_CASES - Other cases with same IOCs
• RELATED_ALERTS - Alerts involving same entities
• PATTERN_ANALYSIS - Detected patterns across cases

Step 2.2: Find Related Open Cases

Invoke: /find-relevant-case with key entities

Document any linked investigations.

Phase 3: Specialized Analysis

Step 3.1: Route by Alert Type

Based on ALERT_TYPE, invoke specialized triage:

| Alert Type | Skill | Focus | |------------|-------|-------| | Malware | /triage-malware | File analysis, behavior, persistence | | Authentication | /triage-suspicious-login | User activity, login patterns | | Network | /pivot-on-ioc | Network IOC relationships | | Other | Continue to pivoting | General IOC expansion |

For Malware: Invoke: /triage-malware FILE_HASH=$hash CASE_ID=$CASE_ID

Collect:

• Malware family identification
• Behavioral analysis
• Affected systems
• Containment recommendations

For Authentication: Invoke: /triage-suspicious-login USER=$user CASE_ID=$CASE_ID

Collect:

• Login anomaly analysis
• User activity timeline
• Compromised account indicators
• Account status recommendations

Phase 4: Expansion

Step 4.1: Pivot on High-Confidence IOCs

For each high-confidence malicious IOC:

Invoke: /pivot-on-ioc IOC_VALUE=$ioc

Collect:

• RELATED_INFRASTRUCTURE - Connected domains, IPs, files
• CAMPAIGN_LINKS - Associated campaigns or actors
• ADDITIONAL_IOCS - New IOCs to hunt for

Step 4.2: Validate Expanded IOCs

For significant new IOCs discovered:

• Quick GTI lookup
• SIEM presence check
• Add to investigation scope if relevant

Phase 5: Assessment

Step 5.1: Determine Investigation Outcome

Assess all findings and classify:

| Outcome | Criteria | Action | |---------|----------|--------| | Incident Confirmed | Active compromise, ongoing threat | Escalate to IR | | Resolved - Contained | Threat neutralized, no ongoing risk | Document & Close | | Resolved - False Positive | Deep analysis confirms benign | Document & Close | | Requires IR Escalation | Containment/eradication needed | Escalate to IR |

Step 5.2: Execute Disposition

If Incident Confirmed / Requires IR:

1. Invoke: /document-in-case with full findings
2. Output escalation recommendation:
3. Recommend specific IR skill:
4. Ransomware indicators → /respond-ransomware
5. Malware persistence → /respond-malware
6. Phishing origin → /respond-phishing
7. Account compromise → /respond-compromised-account
8. Prepare handoff package for IR team

If Resolved:

1. Invoke: /document-in-case with:
2. Investigation summary
3. All queries and findings
4. Resolution rationale
5. If closing: Invoke: /close-case-artifact with appropriate reason

Phase 6: Documentation

Step 6.1: Generate Investigation Report

Invoke: /generate-report REPORT_TYPE=investigation

Include:

• Executive summary
• Investigation timeline
• All IOCs analyzed (with verdicts)
• SIEM queries used
• GTI findings
• Correlation results
• Attack chain (if identified)
• Recommendations
• Lessons learned

Outputs

| Output | Description | |--------|-------------| | INVESTIGATION_OUTCOME | Incident, Resolved, or Escalated | | THREAT_ASSESSMENT | Severity, scope, and attribution | | ALL_IOCS | Complete list of analyzed IOCs with verdicts | | ATTACK_CHAIN | Reconstructed attack timeline (if applicable) | | REPORT_PATH | Path to investigation report | | ESCALATION_DETAILS | If escalated, target and handoff package |

Error Handling

• If /deep-dive-ioc fails → Fall back to /enrich-ioc, continue
• If GTI Enterprise features unavailable → Document limitation, use Standard features
• If specialized triage fails → Document, continue with general analysis
• If correlation timeout → Proceed with available data, note gap

Performance Targets

• Total workflow time: < 2 hours
• Deep dive per IOC: < 15 minutes
• Correlation: < 10 minutes
• Specialized triage: < 30 minutes
• Report generation: < 15 minutes
• Target accuracy: > 95% correct assessment