investigation-creation

What problem does it solve?

This skill creates comprehensive investigations from security events, detections, or LCQL queries, capturing host context, lateral movement, and organizational scope to produce SOC-friendly reports.

Core Features & Use Cases

• HOLISTIC investigations: initial access, host context, scope, and lateral movement
• Builds Investigation Hive records with findings, events, detections, and analyst notes
• Useful for incident response, threat hunting, alert triage, and SOC reporting

Quick Start

Start an investigation by feeding a security event or LCQL query, then let the skill build a full Investigation Hive record.