Skip to main content

System Workflow

This page explains the full investigation lifecycle, from a Windows endpoint event to an analyst-facing AI summary and follow-up investigation workflow.

End-to-end flow​

Sysmon event
  -> endpoint agent
  -> event normalization
  -> JSON rule evaluation
  -> local enrichment
  -> alert upload
  -> API Gateway
  -> Lambda processing
  -> DynamoDB and S3 storage
  -> Pinecone retrieval
  -> Bedrock Claude Sonnet 4 analysis
  -> analyst console
  -> follow-up chat and correlation

1. Endpoint telemetry​

Sysmon generates detailed Windows telemetry such as process creation, network connections, image loads, file events, registry changes, DNS queries, process access, process tampering, WMI events, and file deletion activity.

The endpoint agent reads these events and converts them into a stable schema so later components do not need to depend on raw event formatting.

2. Detection​

The agent evaluates JSON detection rules against normalized fields. A rule can match on process name, command line, file path, destination address, API behavior, registry activity, or other telemetry fields.

Rules are grouped into categories such as:

  • Execution
  • Discovery
  • Collection
  • Credential access
  • Defense evasion
  • Command and control
  • Persistence
  • Lateral movement
  • Exfiltration
  • False-positive exclusions

3. Local enrichment​

When a rule matches, the agent builds context around the alert:

  • Process ID and process name
  • Command line
  • Parent process relationship
  • User account
  • File path and hash where available
  • Signature status
  • Hostname and agent identity
  • Timestamp and category

This enrichment gives the backend and AI layer more than a single detection line.

4. Backend ingest and storage​

The alert is uploaded over HTTPS to API Gateway and processed by Lambda services. The backend validates the payload, stores hot investigation data in DynamoDB, and uses S3 where larger evidence or retrieval artifacts are needed.

The browser and endpoint never receive direct AWS service credentials for DynamoDB, S3, Bedrock, or Pinecone.

5. Retrieval​

Before AI analysis, the backend can query Pinecone for:

  • Relevant MITRE ATT&CK technique context
  • Similar historical events
  • Supporting rule or investigation context

This retrieval step helps the AI output stay grounded in evidence instead of producing generic security explanations.

6. AI analysis​

Amazon Bedrock Claude Sonnet 4 receives structured alert context and retrieved evidence. The output can include:

  • Plain-language summary
  • Classification and risk level
  • Reasoning
  • Key indicators
  • MITRE ATT&CK mapping
  • Confidence and retrieval signal
  • Recommended next steps
  • IOCs when supported by event evidence

7. Console investigation​

The analyst console brings the evidence and AI output into one workflow:

  • Overview metrics show alert volume and agent health.
  • Events search and filters help prioritize detections.
  • Event details expose process, file, network, and system metadata.
  • Process Tree shows parent-child process lineage.
  • AI Analysis explains the alert.
  • Follow-up chat answers event-specific analyst questions.
  • Multi-alert correlation groups related detections into a broader incident narrative.