System for Referring Endpoint Security Events for Correlation Review

The problem

In day-to-day operations, EDR events and asset and user context arrive through different systems and event records, preventing the team from seeing the case on a single timeline.

As a result, source links can be lost while the related event group and evidence summary are prepared, the case can be routed to the wrong team, and the basis for the technical decision can remain unclear.

An incomplete workflow may overlook missing telemetry or an affected critical user, while an incorrect system action could quarantine a device incorrectly.

What we set out to improve

• Time taken for the draft related event group and evidence summary to be ready for specialist review
• Correct referral of records involving missing telemetry or an affected critical user to the appropriate specialist queue
• Record of recommendations corrected or rejected by the SOC analyst

How the system works

1. 01 Retrieve EDR events and asset and user context from authorised sources
2. 02 Verify the source, timestamp and record identifier
3. 03 Add the relevant asset, user, shop, vehicle or content context
4. 04 Prepare a draft related event group and evidence summary
5. 05 Compare the draft with technical rules and authority boundaries
6. 06 Check for exceptions: missing telemetry or an affected critical user
7. 07 Obtain the SOC analyst's approval, correction or rejection
8. 08 Write the input, recommendation, changes and final decision to the audit log

Methods we used

• Source- and time-traceable data extraction for EDR events and asset and user context
• Structured output that restricts the related event group and evidence summary fields to technical rules
• An exception gate that separates cases involving missing telemetry or an affected critical user from system action
• An authorised queue that presents the evidence and recommendation together for the SOC analyst
• Duplicate-processing controls and a rollback record to address the risk of quarantining a device incorrectly

Where people stay involved

Data and security

Only fields required for the task are processed from EDR events and asset and user context. Source-system permissions are preserved, and unnecessary personal, technical and security-sensitive data is minimised before being sent to the model. Every retrieval, recommendation, human change and target-system action is written to the audit log.

Who this suits

Frequently asked questions