Investigator

Reduce triage time with autonomous triage

Corelight Investigator reduces investigation time by automating triage that consolidates and analyzes the highest-priority entities in your environment every 24 hours:

• Agentic Triage uses transparent, expert-written playbooks to follow consistent, defensible triage logic for every investigation
• Automatically investigates the last seven days of host activity to identify persistent patterns, lateral movement, and long-term TTPs
• Performs advanced detection correlation and analyzes dozens of raw log queries to unify disparate data points into a single narrative
• Provides analysts with a ready-to-use narrative, reasoning, and recommended next steps, eliminating the need for manual data stitching

Expand detection, validation, and coverage

Investigator enhances detection impact by validating alerts through structured investigative workflows:

• Transparent AI/ML models
• Behavioral, signature, threat intel, and query-based detections
• MITRE ATT&CK^® coverage across 100+ techniques
• Deep visibility into Defense Evasion, Credential Access, Discovery, and C2

Increase SOC efficiency with entity-centric investigation

Investigator empowers analysts to make informed decisions quickly by capturing all relevant data within a structured investigation framework. Automated playbooks, explainable AI summaries, and triage history reduce skill gaps and enable junior analysts to perform at senior levels:

• 3x more cases handled per analyst
• Toolset and dataset consolidation
• Single-screen, entity-based triage experience
• Out-of-the-box and customizable dashboards
• Easy access to raw data and GenAI summaries

Enhanced response capabilities with built-in containment

Investigator allows analysts to move from verified investigation to response within the same interface. With a single click, analysts can isolate compromised hosts, enforce firewall policy changes, and trigger response actions directly from validated cases:

• Detection-to-response within one workflow
• One-click host isolation and containment
• Streamlined workflows that reduce response times
• Evidence-backed justification for every action taken

Situation

A global beauty retailer needed deeper network visibility to protect thousands of point-of-sale (PoS) terminals and proactively hunt for threats across its corporate environment.

Challenge

Identifying a single compromised device among thousands is difficult, especially when threats range from hidden C2 channels to malicious .onion traffic designed to exfiltrate card data.

Solution

Corelight Investigator flagged a DNS query to a malicious .onion domain from a PoS terminal. Corelight’s evidence also revealed previously unseen threats on the corporate network, including C2 beaconing and unauthorized bitcoin mining.

Results

The team immediately isolated the compromised PoS terminal, averting a data breach. They also used the evidence to re-image several other compromised workstations, validating their threat hunting program.