What it does
The AI investigate playbook block lets the model ask questions of your data before the verdict: what else did this host do in the last hour, has this user logged on from this address before, where else has this hash appeared. It turns those questions into queries, runs them, and folds the results into the material the verdict is based on.
The bounds
- Read only. The agent queries; closing, assigning, isolating and notifying stay with people and playbooks.
- Guarded queries. Every query is limited to the alert's organization, to a time range and to at most 100 rows. Queries that would scan too broadly are refused before they run.
- A fixed budget. Set the number of queries, from one to five, on the block. When the budget is spent, the verdict is produced from what was gathered.
- Transparent. Every query and its result are listed on the alert's AI workflow tab.
When to use it
Bind it to detections where context changes the answer: authentication anomalies, rare process ancestry, first-seen destinations. For detections whose verdict is obvious from the event itself, skip it and save the budget.