Platform Overview
The AI-Driven EDR platform is an endpoint investigation system designed to reduce the manual effort required after a suspicious event is detected. It combines Windows telemetry, JSON detection rules, forensic enrichment, cloud processing, retrieval, and AI-assisted analysis into one investigation workflow.
The system is not only an alert viewer. It is built to answer the follow-up questions analysts normally ask after a detection appears:
- What happened on the endpoint?
- Which rule fired and why?
- What process chain led to the alert?
- Is the behavior likely malicious, suspicious, or benign?
- Which evidence supports that conclusion?
- Are there related alerts or similar historical events?
- What should be investigated next?
Core idea
Traditional endpoint tools are good at producing detections, but the investigation stage still requires analysts to manually reconstruct context from process IDs, command lines, hashes, timestamps, parent-child relationships, and network fields.
This platform focuses on that post-detection stage. It turns raw endpoint evidence into a structured investigation record, then uses retrieval-grounded AI to produce explanations, MITRE ATT&CK context, IOCs, and next-step guidance.
Major subsystems
| Subsystem | Role |
|---|---|
| Endpoint agent | Collects Sysmon telemetry, evaluates rules, enriches matched events, and uploads alerts |
| Detection rule engine | Applies JSON rules grouped by behavior categories such as execution, discovery, persistence, and credential access |
| Cloud backend | Receives alerts, stores evidence, serves dashboard APIs, and orchestrates AI/retrieval workflows |
| Retrieval layer | Uses Pinecone to retrieve ATT&CK context and semantically similar events |
| AI layer | Uses Amazon Bedrock Claude Sonnet 4 to generate grounded investigation analysis |
| Analyst console | Provides event triage, process trees, AI analysis, follow-up chat, rules, agents, and administration |
Key capabilities
- Sysmon-based Windows endpoint monitoring
- JSON rule authoring and category-based detection management
- Alert search, filtering, lifecycle status, and pagination
- Event details with process, file, network, and system metadata
- Process tree reconstruction with parent-child execution context
- VirusTotal hash lookup support
- AI-powered alert analysis with reasoning, indicators, risk, confidence, and MITRE mapping
- Event-level follow-up chatbot for analyst questions
- IOC extraction from alert evidence
- Multi-alert correlation for broader attack-chain review
- Agent health and heartbeat visibility
- User management and login activity auditing