Overview

SCU Cost Estimate

This agent typically consumes 0,2-3 SCUs per incident analysis, depending on incident complexity, number of entities involved, and depth of threat intelligence enrichment.

Introduction

Forensic Agent Core is your automated incident analyst. If you've ever looked at a Defender XDR incident and thought "I need the full story, not just scattered alerts", this agent is for you. It takes an incident ID, pulls together everything related, enriches it with threat intelligence, builds a minute-by-minute timeline, and delivers a comprehensive forensic report that would normally take hours of manual investigation.

What It Does

• Reconstructs incident timelines minute by minute from scattered alerts and events

• Extracts and maps entities (devices, users, IPs, domains, files, hashes) and their relationships

• Enriches with threat intelligence using multiple sources (Shodan, SSL certs, WHOIS, CIRCL, reputation services)

• Analyzes device security posture showing vulnerabilities, software, and configuration

• Tracks identity activity with risk events and authentication patterns

• Correlates analyst comments to provide investigation context

• Classifies incidents as True Positive, False Positive, or needs escalation with malicious intent scoring

• Recommends remediation with prioritized, actionable steps

• Generates standardized reports ready for handoffs, audits, or escalation

Use Cases

1. Incident Triage and Initial Assessment

You have a new high-severity incident and need to quickly understand what happened. Forensic Agent Core analyzes the incident, builds a timeline, identifies key entities, and provides a classification (True/False Positive) with confidence scoring. Instead of spending 30-60 minutes gathering context, you get a complete picture in minutes.

2. Preparing Incident Reports for Management

Leadership wants a clear explanation of a security incident. The agent generates a comprehensive forensic report with an executive summary, timeline, entity map, threat intel findings, and remediation recommendations. Everything is standardized and ready to present, no manual report writing needed.

3. Threat Intelligence Enrichment

An incident involves external IPs and domains, but you don't know if they're malicious. Forensic Agent Core enriches all indicators with open-source and commercial threat intelligence (Shodan port scans, SSL certificate analysis, WHOIS data, malware associations, reputation scores). You get curated intel that highlights what actually matters.

4. Deep-Dive Forensic Analysis

A critical incident requires detailed investigation before response. The agent performs advanced hunting queries, extracts all related entities, analyzes device and identity posture, correlates events into a precise timeline, and provides forensic-level detail about what happened, when, and how. Save hours of manual correlation work.

5. SOC Team Handoffs and Escalations

You need to escalate an incident to Tier 2 or external forensics team. The agent's standardized report provides complete context, timeline, entity relationships, threat intel, and initial analysis. The receiving team can pick up immediately without asking for clarification or redoing research.

Why Forensic Agent Core?

The Problem You're Dealing With	How This Helps
Fragmented alerts everywhere: Incident has dozens of alerts, unclear how they relate	Complete timeline: Minute-by-minute reconstruction showing how events connect
Missing context: Alerts show what happened but not why or what it means	Entity mapping: Full picture of devices, users, IPs, domains, and their relationships
Manual threat intel lookups: Copying indicators into multiple tools takes forever	Automated enrichment: All indicators enriched with curated intel from multiple sources
Device and identity data disconnected: Can't see how user activity relates to device events	Integrated analysis: Device posture and identity activity correlated in one view
Time pressure for reports: Management wants detailed analysis but you have 30 minutes	Ready-made reports: Comprehensive forensic report generated automatically
Noisy intel feeds: Too much information, unclear what's actually important	Curated findings: Agent highlights what matters, filters out noise

How It Works

What goes in:

• Incident ID from Microsoft Defender XDR

• Associated alerts, entities, and evidence

• Analyst comments and investigation notes

• Device and user activity data

• Threat intelligence feeds (Shodan, CIRCL, reputation services)

What it does:

• Retrieves complete incident data including all alerts and entities

• Performs advanced hunting queries to find related activity

• Extracts all entities (devices, users, IPs, domains, files, hashes)

• Builds entity relationship map

• Reconstructs minute-by-minute timeline from events

• Enriches external indicators with threat intelligence

• Analyzes device security posture (vulnerabilities, software, config)

• Tracks identity activity and risk events

• Correlates analyst comments with timeline

• Classifies incident with malicious intent scoring

• Generates prioritized remediation recommendations

What you get:

• Executive summary with key findings and classification

• Minute-by-minute timeline of incident progression

• Entity inventory with relationships (who, what, where, when)

• Device security posture summary (vulnerabilities, software, security controls)

• Identity activity summary (authentication, risk events, behavior)

• Threat intelligence findings:

  • Open ports/services/vulnerabilities (Shodan)

  • SSL certificate metadata and validation

  • WHOIS registration data

  • Malware associations and file reputation (CIRCL)

  • IP/domain reputation scores

• Incident classification (True Positive, False Positive, Escalate)

• Malicious intent confidence score

• Prioritized remediation recommendations with specific actions