Fourteen findings. One case, with a verdict.
The agent watches credential theft, persistence, defence evasion, lateral movement and pre-ransomware behaviour in real time. What reaches an analyst is not that stream. It is a single case that asks the only question worth asking first: is this real?
- Time to acknowledge
- 12m
- SLA overrun
- 3h 17m
- Correlated signals
- 3
Alerts are not the hard part. Deciding is.
An investigation is deliberately separate from a risk, because it answers a different question. A risk asks what to fix. An investigation asks whether the behaviour is real at all, before anyone spends a morning on it.
One record, not one per detection
Related signals correlate into a single working case. A signal that fires again after a case is closed opens a new one instead of quietly reviving the old record, so the timeline never misreports when the activity started.
Durations, not timestamps
Case age, time to acknowledge, time to contain and SLA overrun are shown as durations, which is the form an SLA is written in and an MSP reports on. Time to acknowledge measures the first human touch, not the detection that opened the case.
The next responder can tell what was done
Playbook steps carry completion state and a note recording what was actually carried out, rather than a read-only list. Dismissal reasons are presets, because a free-text box on its own produces "fp", "test" and blanks, which is worthless as tuning input.
A chain reads as a chain, not fourteen alerts.
Forty-one attack chains are checked on each device inside a 30-minute window. Twenty-two of them pair a real-time detection with a configuration change, so a cleared security log followed by antivirus switched off is one chain, not two unrelated cases.
- Four chains open as Possible rather than Suspected, so the doubt is recorded on the case, not in a comment.
- Findings and changes merge into one sequence, tagged with the technique the agent actually reported.
- The case window is fixed, never sliding. Low and slow cannot hold it open.
- A signal that keeps firing folds into its untouched open case for a day, instead of opening a new one every half hour.
Three correlated batches, one window, one case.
Four alerts are one attack. The case should say so.
On every heartbeat, per device, Secuno groups what the agent reported by process lineage and a ten-minute window, configuration changes and behavioural deviations included, and matches the cluster against sixteen known attack patterns. The result is one story with a verdict (blocked, active or contained), a confidence, a plain-English summary, the MITRE chain and a timeline with one line per step. For a matched pattern it adds the sentence that matters most: what the technician should do next, not only what happened.
The investigation is the case of record
A story at 70% confidence or with a strong score opens an investigation, and the story lives on it. The analyst's decisions on the case set the story's verdict, and an automatic closure never counts as a false-positive call. Three false-positive marks on one pattern quiet it for that client for ninety days, and never for any other client.
One attack across devices, one case
When lateral movement, DCSync or roasting on a second device names the same user, the two stories merge into one cross-device incident, always critical, with the timeline tagged per device. The attack's next hop is not a second ticket.
Behavioural evidence, stated narrowly
Each device keeps a baseline of the suspicious behaviour it has already shown, and a deviation inside a story's window joins that story as evidence. It learns what is newly suspicious on a device, not everything that is normal, and its comparisons arm after fourteen days of observation.
Detected today. Started when?
When an analyst confirms a story active or contained, Secuno re-reads that device's last ninety days knowing which signal types and tactics the confirmed attack used. Events that sat below the alert threshold at the time are scored again in that light.
- A probable initial access date with a stated confidence of high, medium or low, the dwell period, and a retrospective timeline from probable entry to detection
- A plain-English scope statement built from what the device could reach: sessions, shares, listening services and local administrators
- The NIS2 Article 23 clocks, the 24-hour early warning and the 72-hour notification, counted from the probable first access alongside the same clocks from detection
- When nothing in the window re-scores above threshold, it says so rather than guessing a date
Contain it without leaving the case.
Containment used to live only on the device page, behind a raw command dropdown. An analyst watching files being encrypted had to leave the investigation to stop it. The case now offers ten verbs, seven on its device and three on its Microsoft 365 account, and every one is mirrored into its activity trail.
- Isolate or release the host, kill a process or its whole tree, quarantine a file, stop or disable a service, on this investigation's device only
- Revoke sessions, disable or re-enable the account the case is about, on Microsoft 365 tenants that opted in. A case that groups alerts about more than one account refuses, and says why
- Every action is recorded in the case activity trail alongside analyst notes, status changes, assignments and escalations
- Confirmed investigations escalate into a formal incident or a risk, carrying affected devices, responders, linked risks and tickets. An incident runs open, contained, eradicated, recovered, closed, with a post-incident report
What the agent will do, and what it refuses.
The backend validates every queued command against an allow-list rather than accepting any string and leaving the agent to reject it. Of the ten command types, these seven are the ones a case can send. The refusals are the interesting part: each one exists because the alternative is a support call at three in the morning.
Isolation carries a local time-to-live, renewed by every successful heartbeat. A device you can still reach stays isolated for as long as you need. A device you cannot reach rejoins the network rather than sitting cut off with no remote way back. Every heartbeat re-checks that each expected filter is still present in live kernel policy, and reports a repair as a tamper signal.
The things worth asking first.
How is an investigation different from a risk?
A risk asks what to fix and carries an owner, a deadline and remediation steps. An investigation asks whether a behavioural signal is real at all. It runs new, triaging, then confirmed or dismissed, and a confirmed case escalates into a formal incident or a risk when remediation is actually required.
What happens when the same signal fires again after a case is closed?
A new case opens. The correlation key includes the time the case was opened, so a recurrence cannot silently revive a closed record. Without that, the timeline on a reopened case would misreport when the activity began, which is the one thing an incident report has to get right.
Can a slow attacker hold the correlation window open?
No. The window is a fixed length and deliberately does not slide. A sliding window can be held open indefinitely by a low-and-slow signal, and that is precisely the case where an accurate start time matters most.
If we isolate a device, can we lose it?
The isolation filters are installed in a single transaction that always carries the agent's own exception, so the host is never blocked without a way for the agent to talk back, and the command is refused outright if the agent cannot resolve its own path. Isolation then carries a local time-to-live renewed by each successful heartbeat, so an unreachable device rejoins the network instead of being stranded.
Can an obfuscated command line slip past the agent?
Command lines are read the way the shell reads them. Carets, quotes and variable tricks are undone and encoded PowerShell is decoded before anything is classified, and every rule runs over the raw, normalised and decoded forms. The same classifier runs whether the agent sees a process through its kernel trace or through the Security log, so weaker telemetry does not mean weaker detection. A process that lies about its parent is reported as parent PID spoofing with the real creator named, and stopping the agent's trace session is itself a detection.
How much of the queue is noise?
A September review of every open case traced most of the noise to detection defects rather than judgement calls: Windows' own database maintenance read as credential theft, builds and installers read as ransomware, JavaScript engines read as implants. Six sources like these were closed at the detection itself, and a case with one genuine finding among the noise stays open. A signal that keeps firing now adds to its untouched open case instead of opening a fresh one every half hour.
What does an auditor get afterwards?
The case activity trail records every status change, assignment, escalation, analyst note and dispatched response action. Incidents add affected devices and users, responder assignment, linked risks and tickets, and a post-incident report with a PDF export. Investigations measure detection latency and time to first verdict over ninety days. Case reports print without cards splitting across a page boundary mid-evidence.
Bring us a noisy endpoint.
The fastest way to judge a detection story is to watch it triage something real. We will walk a live case end to end, from the signals that opened it to the action that closed it.