# One alert, start to finish.

URL: https://avispa.ai/orbitsoc/investigations/

Avispa OrbitSOC

A team of agents works each case. A person decides.

## How a case moves

1. **1 Context first** · Hosts, users, reputation and history are looked up before any AI runs. · Asset discovery · Enrichment
2. **2 Triage** · The triage analyst sets severity and picks the depth: quick, standard or deep. · Triage analyst
3. **3 Specialists** · The planner dispatches specialists in parallel, round by round. · Planner · Executor · Endpoint · Identity · Network
4. **4 Correlation** · Related alerts are linked into one case. · Correlator
5. **5 Red team** · The red team attacks the conclusion, looking for blind spots. · Red team
6. **6 Checkpoint** · The SOC manager approves, sends it back once, or flags it for escalation. · Response advisor · SOC manager
7. **7 Report** · Written once, after every check, and held to its own evidence. · Reporter
8. **8 A person decides** · Your analyst confirms or overrides. Only a person declares an incident. · Your analyst

Tier 1 Triage and enrichment

- Asset discovery
- Enrichment
- OSINT analyst
- Triage analyst
- OSINT collector
- Health monitor
- Coverage analyst

Tier 2 Deep investigation

- Planner
- Executor
- Correlator
- Endpoint
- Identity
- Network
- Cloud
- Email
- Malware
- Insider threat

Tier 3 Analysis and oversight

- Red team
- Reporter
- SOC manager
- Hunt planner
- Hunt executor
- Detection engineer

Tier 4 Incident response

- Response advisor
- Playbook executor
- IR monitor
- Lessons learned

Your analyst

The case file

1. Recommended outcome, with confidence
2. Executive summary
3. Timeline
4. Evidence artifacts
5. Technical narrative
6. Alternate hypotheses
7. Response steps, mapped to playbooks
8. Report export

**More: replay an attack, and the watch after the verdict**

## Replay any attack.

Storyline replay

Initial access

1. 09:12 Link in a phishing email opened on FIN-WS-22

Execution

1. 09:13 PowerShell runs an encoded command
2. 09:41 Archive tool runs on APP-SRV-07

Persistence

1. 09:15 Scheduled task created to run at sign-in

Credential access

1. 09:21 A process reads LSASS memory

Lateral movement

1. 09:33 Remote desktop to APP-SRV-07 as a.rivera

Exfiltration

1. 09:52 1.2 GB sent to cdn-update.example

Response

1. 09:54 Recommended: contain FIN-WS-22 and APP-SRV-07

- FIN-WS-22
- APP-SRV-07
- a.rivera
- 203.0.113.24
- cdn-update.example
- powershell.exe
- rundll32.exe
- 7z.exe

09:55

Step through or play end to end, at 0.25× to 4×, for handoffs and reviews.

[See a live investigation · (opens orbitsoc.com)](https://www.orbitsoc.com/investigation-storyline?view=storyline)

## The watch keeps going after the verdict.

After escalation, agents keep re-checking the hosts, accounts and IPs involved. Every 15 minutes, then hourly, every 4 hours and every 12 hours, for up to 7 days.

- Host · **FIN-WS-22**
- Account · **a.rivera**
- IP · **203.0.113.24**

**15 min** · **1 h** · **4 h** · **12 h**

Escalated · up to 7 days

## Bring an alert you know to the demo.

[Book a demo](https://avispa.ai/book-a-demo/) · [See a live investigation · (opens orbitsoc.com)](https://www.orbitsoc.com/investigation-storyline?view=storyline)