The adaptive loop
Six stages, one continuously improving investigation
- 01
Alert
Correlated telemetry arrives as an alert with severity, risk score and an initial hypothesis. Example: INC-1047, 47 failed logins followed by a successful sign-in and PowerShell execution, initially read as a possible brute-force attack.
- 02
Recall
Before any conclusion is drawn, the evidence pattern is matched against retained experiences. Three previous investigations surface with similarity scores and the decisions analysts made at the time.
- 03
Investigate
Current evidence and recalled experience are analysed together. The reasoning is shown progressively so the analyst can follow how the assessment is formed.
- 04
Decide
The analyst confirms, rejects or modifies the assessment. A reason is required in every path, and a modified hypothesis replaces the AI statement in the record.
- 05
Retain
The decision, reasoning and outcome are written back as a new experience, optionally pushed to the external memory service, and the investigation is closed.
- 06
Adapt
The next alert with a comparable pattern recalls this experience, so the investigation starts from what the organization learned rather than from zero.