Investigate incidents with AI agents
Query Splunk, CrowdStrike, and Okta to build a source-linked incident timeline. Have an AI agent propose root cause hypotheses, then assess scope and preserve the investigation record.
Tools for incident analysis
MCP servers for the tools used in these examples.
Okta
AWSAutomation examples and starter prompts
Paste a prompt into Claude Code, Microsoft Copilot, or Codex connected to Tracecat MCP. Adapt it to your tools and test before deployment. Human tool approvals and advanced case features require Enterprise.
Build incident timelines with an AI agent
Build me an investigation assistant in Tracecat. For an active case, have an AI agent query Splunk, CrowdStrike, and Okta sign-in logs around the indicators, assemble a single ordered timeline of process, network, and identity events, and write it to the case with each entry linked to its source query. Have the agent propose root cause hypotheses ranked by the evidence. First help me understand how this maps to RS.AN-03 and what separates a defensible root cause from a plausible story. Ask me which log sources I can query and their retention windows. Talk me through how the agent should mark gaps where evidence is missing.
Preserve investigation records and evidence
Build me an evidence preservation automation in Tracecat. For incident cases, record every investigative action in the case timeline automatically, snapshot collected artifacts to a write-once S3 bucket in AWS with hashes computed at capture, and keep a chain-of-custody table of who collected what, when, and from where. First help me understand how this maps to RS.AN-06 and RS.AN-07, and what makes records hold up when legal or insurers ask. Ask me what retention our counsel expects for incident evidence. Talk me through what must be captured at the moment of action versus what can be reconstructed.
Estimate and validate incident magnitude
Build me a magnitude estimation step in Tracecat. For an active incident, count affected hosts, accounts, and data stores from Splunk queries, cross-check against asset and exposure data from Wiz, and write a magnitude estimate to the case with the queries that produced it. Re-run on demand so the estimate tracks the investigation instead of going stale. First help me understand how this maps to RS.AN-08 and why magnitude needs validation from a second source. Ask me which magnitude bands drive different responses for us. Talk me through presenting uncertainty honestly when counts are still moving.
NIST CSF 2.0 mapping: RS.AN
Official NIST category: Incident Analysis. Investigations are conducted to ensure effective response and support forensics and recovery activities
The controls and implementation examples below are NIST source material. The automation prompts above are Tracecat-authored starting points, not evidence of compliance or full control coverage.
- RS.AN-03AU-7IR-4SI-2(7)
Analysis is performed to establish what has taken place during an incident and the root cause of the incident
- Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event
- Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident
- Analyze the incident to find the underlying, systemic root causes
- Check any cyber deception technology for additional information on attacker behavior
- RS.AN-06AU-7IR-4IR-6
Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
- Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable
- Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported
- RS.AN-07AU-7IR-4IR-6
Incident data and metadata are collected, and their integrity and provenance are preserved
- Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures
- RS.AN-08IR-4IR-8RA-3RA-7
An incident's magnitude is estimated and validated
- Review other potential targets of the incident to search for indicators of compromise and evidence of persistence
- Automatically run tools on targets to look for indicators of compromise and evidence of persistence
Control text and SP 800-53 Rev 5 references from the official NIST CSF 2.0 and OLIR releases.
Build your own security automation
Adapt a starter prompt with your coding assistant, choose where AI agents or fixed workflows fit, and test with your tools.