Security alerts provide a starting point for investigation, but they rarely tell the whole story. This is where AI security transforms SOC operations.

An alert may identify a suspicious authentication, unusual process, or connection to a potentially malicious IP address. Investigating only that activity may determine whether the alert is a false positive, but it does not always answer the more important question: Has the associated user, host, or environment been compromised? Modern AI security approaches take a broader perspective, examining the full context of an incident rather than isolated alerts.

The AI security Incident Investigation workflow in SCALR AI takes a broader approach. It uses an alert as the trigger for a comprehensive examination of the users, hosts, IP addresses, and other entities involved. Its objective is not simply to determine if a specific alert is a true/false positive, but to identify potential compromise, understand its scope, and help the security team determine what should happen next. It does all of this faster and more consistently then an average security analyst, allowing organizations to have faster resolution times while also increasing the quality of their investigations. The AI security incident investigation workflow represents a fundamental shift in how alerts are triaged.

What Is the Incident Investigation Workflow?

The AI Security Incident Investigation workflow begins with the context available in an incident or alert. It identifies relevant entities and performs checks intended to uncover related signs of suspicious or malicious activity.

Depending on the incident, these entities may include:

• Users and service accounts
• Workstations and servers
• IP addresses
• Domains and URLs
• Processes, files, and hashes

Consider a suspicious authentication alert. A narrow investigation may focus only on whether the login was legitimate. The Incident Investigation workflow may also examine whether the user generated other unusual activity, the source IP interacted with additional systems, the user’s endpoint shows signs of compromise, or the account recently experienced privilege or authentication changes.

The alert establishes the starting point of the investigation – not its boundaries.

Purpose-Built AI Security Workflows in the free SCALR AI platform

SCALR AI helps security teams apply AI through repeatable, purpose-built workflows. Unlike a single prompt or open-ended AI conversation, a workflow coordinates specialized AI, integrations, automation, and decision logic to accomplish an operational task. This AI security methodology shifts from binary alert validation to comprehensive compromise assessment.

Think of a SCALR AI workflow as a digital security operations playbook:

• An LLM provides the reasoning.
• An Agent acts as a specialized digital analyst.
• Tools give the analyst access to data and actions.
• Smart Edges make routing decisions based on the evidence.
• The workflow coordinates the complete process.

A workflow is composed of Agents, Smart Edges, and Workflow Only Tools. With Workflow Only tools bringing deterministic outcomes to an otherwise nondeterministic world. This helps build more reliable outcomes, something that SOCs depend on.

A quick primer on SCALR AI Workflows

Agents

Agents are AI security-specialized, LLM-powered components given a specific purpose through a System Message, along with the tools needed to fulfill that purpose. One Agent may specialize in identity investigations, while others focus on endpoint activity, threat intelligence, or evidence correlation.

Agents can be reused across workflows and refined through Additional Directives. For example, an identity Agent could be directed to look for account takeover in one workflow and inappropriate privileges in another.

Each Agent can also use a different LLM. This enables teams to balance reasoning capability, speed, and cost by selecting the right model for each task rather than using the same model throughout the workflow.

Tools

SCALR AI supports two categories of tools:

• AI Security Agent Tools are selected and initiated by an Agent based on its instructions and findings. These may include MCP servers, custom Python tools, Logic Apps, webhooks, and security product integrations.
• AI Security Workflow Only Tools are deterministic steps invoked directly by the workflow rather than by an LLM. They can retrieve or transform data, call an API, update a case, or perform another predefined action without consuming LLM tokens.

This distinction allows SCALR AI to combine SOAR-style automation with AI-driven reasoning. Predictable tasks remain deterministic and efficient, while Agents handle work requiring interpretation and adaptability.

Smart Edges

Smart Edges are natural-language decision points that determine where the workflow should go next. They evaluate the latest Agent and Workflow Only Tool outputs, then choose among the available paths according to their instructions.

A Smart Edge can select more than one path. If an incident involves both a user and a host, for example, it can initiate identity and endpoint investigations in parallel. The workflow waits for the selected branches to finish before bringing their findings together.

This combination gives workflows both consistency and flexibility. Required steps can always occur, while the investigative path adapts to the evidence in each incident.

How the AI Security Incident Investigation Workflow Operates

The exact path depends on the incident and available data, but the workflow follows several high-level stages. Here’s how the AI security workflow operates:

1. Collect Incident Context

The workflow grabs the highest severity, oldest incident that is tagged for investigation, collects the alert details, including the detection, timestamps, triggering events, evidence, and associated entities, and then adds a tag to the incident to note it is being enriched.

2. Identify and Route Entities

Users, hosts, IP addresses, and other relevant entities are identified. Smart Edges then determine which investigative paths to initiate, including multiple paths in parallel when appropriate. Each agent that the Smart Edge identifies as a needed next step will run in parallel. So user, host, and IP investigations are happening concurrently, something a human can’t do.

Investigate Users

For users and accounts, the workflow may examine:

• Successful and failed authentications
• Unusual locations, networks, or devices
• Authentication method changes
• Privilege and group membership changes
• Related alerts and activity across applications
• Behavior inconsistent with the account’s expected use

Investigate Hosts

For endpoints and servers, it may evaluate:

• Related endpoint detections
• Suspicious processes or files
• Persistence mechanisms
• Unexpected network connections
• Security control changes
• Signs of credential access or lateral movement

This broader review is important because a host may show signs of compromise even if the original alert is ultimately determined to be benign.

Investigate IP Addresses

Relevant IP addresses may be checked for:

• Threat intelligence reputation
• Geographic and ownership information
• Known malicious associations
• Previous alerts or incidents

Investigate Process and Hashes

Relevant Processes and Hashes may be checked for:

• Prevalence in the organization
• Sandbox reports
• Process Trees

3. Correlate the Evidence

Once the applicable investigative branches are complete, the workflow combines their findings.

A suspicious login may have a legitimate explanation when viewed alone. The same login becomes more concerning when paired with unexpected privilege changes, malicious process execution, or communication with known threat infrastructure.

The workflow identifies evidence that supports a benign explanation, evidence suggesting compromise, relationships between events, and remaining investigative gaps.

4. Identify Additional Entities

Review the list of findings and identify if any additional entities need to be investigated. For instance, a new process found in a process tree that is worth examining, or a user was executing suspicious processes on a host.

Perform all the same checks on this new set of evidence as in Step 2.

5. Determination

Using an agent with a higher reasoning effort, review all the evidence thus far, and determine if the incident is a False Positive, or a True Positive (or needs more manual investigation). This AI security determination helps teams move beyond simple true/false verdicts.

6. Summarize Findings and Next Steps

The workflow produces a structured assessment and recommended actions. These may include:

• Closing the incident as a false positive
• Escalating it for additional analysis
• Disabling an account or revoking sessions
• Isolating an endpoint
• Blocking a malicious indicator
• Collecting forensic evidence
• Searching for related activity
• Initiating incident response

The security team retains the final decision. SCALR AI provides a broader and more consistent foundation for making it.

AI Security Automation Across Response Levels

SCALR AI can go further by closing False Positives, using Human In The Loop response capabilities, or going automatically isolating hosts. Workflows are easy to build, highly customizable and help bring more deterministic outcomes in a nondeterministic world.

AI Security Incident Investigation in a Real Environment

A non-profit academic medical center with more than $1 billion in revenue and 15,000 employees was looking to validate an alert as a true or false positive, and if it was positive what actions needed to be taken to reduce impact, before an analyst’s took the time to review the alert.

In one representative case, the workflow identified an alert, tagged it for investigation in Sentinel, and determined through its entity-based analysis that the tool in question was a sanctioned, company-wide communication application rather than a threat. The workflow documented this conclusion in a full six-page report detailing the process and evidence behind the determination, giving the reviewing analyst a complete record to validate rather than a bare verdict to accept.

The result was a substantial reduction in the time required to acknowledge and resolve incidents. With the introduction of the incident investigation workflow and SCALR AI, the SOC’s mean time to acknowledge and mean time to triage were reduced to approximately 2 and 5 minutes, respectively, a significant improvement over the fully manual process that preceded it.

Extending AI Across Security Operations

Incident Investigation is one example of how SCALR AI workflows can support repeatable, time-intensive security processes. Other workflows that may be of interest include:

• Phish Investigator: Using a similar method as the Incident Investigator, we have crafted a workflow that will run checks across user-reported emails to help identify phishing/malicious emails that need immediate attention.
• Daily SOC Summary: What has been happening in your SOC the last 24 hours? Gather all your important metrics, summarize results and have an email ready for you in the morning.
• Log Health Analyzer: Monitor the health of your log sources flowing into your SIEM or data lake, with quick notifications and automated responses.

Together, these workflows can support security teams across the incident lifecycle, from initial investigation through escalation, response, and documentation.

SCALR AI is now available for free download and deployment into your own Azure environment, meaning your AI security data stays in your cloud. Don’t take that to mean that SCALR AI only works in Microsoft land; it can adapt to work with any of your security tools.  Schedule a demo with us to start identifying other opportunities for SCALR AI to enhance your AI security processes.