Deep Dive · Agentic Triage

An AI analyst that shows its work.

Investigations ship enabled for new tenants. Edg3 assembles bounded evidence from the lakehouse and asks the configured reasoning provider for a structured verdict. Analysts see the cited evidence, ATT&CK context, confidence and gate result, and every investigation is labelled with the signal that triggered it. Their decisions are retained in the investigation history rather than silently changing the underlying record.

The Investigation Path

Evidence first. Provider second. Deterministic gates last.

Edg3 does not make product authority depend on a model name. The investigation service builds a structured evidence pack, applies a versioned prompt contract, validates the response schema and subjects the result to deterministic grounding and approval rules. Provider availability is a tenant configuration choice.

Structured evidence

Detections, reusable query results and retrieved context are presented as bounded evidence rather than unrestricted access to the tenant.

Local-first inference

The default investigation path targets an Edg3-operated local model endpoint. External provider adapters require explicit tenant configuration.

Provider portability

The service records the model used and preserves one verdict schema across supported local and explicitly enabled external adapters.

Deterministic authority

Grounding checks, rate limits, confidence policy and human approval determine what can progress. The model does not gain direct response authority.

What Your Analysts See

Investigation results retain their evidence.

A proposed verdict is useful only when the analyst can inspect its basis. The investigation record includes the available evidence, ATT&CK context, confidence, provider identity and deterministic gate result.

exampleIllustrative investigation output
verdictCONFIRMED MALICIOUS · 95% confidence
techniqueT1055.012 · Process Hollowing (Execution)
parentexplorer.exe (legitimate, signed)
childunsigned region within hollowed memory space
outboundC2 IP matched actor TAG-RUBY
blast radius4 endpoints, same tenant, 5-minute window
recommendedhost quarantine · credential revocation · IOC sweep
autonomous?no, analyst approval required

The displayed fields depend on the evidence available for that case. Analysts can use the retained context to reproduce pivots and compare the proposal with the underlying events.

The Review Loop

Analyst decisions remain part of the case.

Confirmations, downgrades and reclassifications are recorded with the investigation. They provide review evidence and can inform a separately governed model evaluation process; they do not automatically retrain a production model.

01

Alert arrives

Detection engine fires on a rule or anomaly. Supported endpoint verdicts and cloud-side analytics detections enter one tenant-scoped investigation path. The Edg3 cloud pulls cross-source context (endpoint, network, cloud, identity) from the lakehouse.

02

The configured provider proposes

The provider returns a structured verdict with technique context, evidence references and confidence. Invalid or ungrounded responses fail the deterministic checks.

03

Analyst reviews

Cited evidence is one-click reproducible. Analyst confirms, overrides, or reclassifies. Disagreement is logged with reason code.

04

Decision enters history

The analyst decision and reason remain in the append-only investigation log for review, reporting and controlled evaluation.

05

Changes stay governed

Prompt, model or policy changes can be tested against retained cases before a new version is selected for production.

Scope

Where the AI triages, and where it holds back.

AI can propose

  • Alert enrichment and event stitching
  • Technique mapping to MITRE ATT&CK
  • Evidence chain construction
  • Confidence scoring and false-positive triage
  • Hypothesis suggestion for hunt queries
  • Tenant-scoped IOC correlation

AI does not directly execute

  • Response execution of any kind: isolation and containment are always routed for analyst approval
  • Credential revocation and account disablement
  • Firewall or DNS blocks
  • Endpoint reimage
  • Any response that fails confidence or grounding policy
  • Anything touching a tenant under investigation hold

Privacy is architectural

Investigation context is sent only to the inference endpoint selected for the tenant. The default path is local-first; external providers require explicit opt-in and should be assessed against the customer’s data-handling policy. Model calls pass through an observability layer that records latency, usage and outcome, with sensitive content redacted from retained telemetry by default. Recursion controls stop the platform investigating its own investigation traffic, and if the inference path is unavailable, detection and alerting continue unchanged; investigations resume when it recovers. A fully self-hosted, no-egress deployment remains on the roadmap. No-egress · Q4 2026

Operational Value

Less context assembly. More analyst review.

The investigation service gathers repeatable query results and cited context before the analyst opens the case. This shifts effort from manual context assembly toward validation, judgement and response. Results still depend on telemetry quality, query latency and the configured inference provider.

Cited
Evidence retained with the result
Scoped
Tenant-configured context and provider
Gated
Deterministic checks before response

For MSSPs, the same structure can standardise how investigations are assembled across the tenants an analyst is authorised to review, while keeping the underlying records scoped.