Security Incident Timeline Agent

When an incident is opened, investigators need to know quickly what happened, when and where, but logs live in five different tools. This agent pulls endpoint, identity, email and network logs for the affected users and hosts and builds one timeline, marking suspicious events. It looks for the entry point and any spread. Every new host or account it finds goes back into the search, and it repeats until a pass finds no new related entities. Activity from known admin tools is labeled as possibly legitimate and confirmed with the admin team. It then drafts a scope summary and containment steps, such as isolating a host or resetting credentials. A security engineer must approve every containment action; the agent never executes one alone. Edge case: a shared service account that appears everywhere is flagged for review rather than expanding the search without limit.