The planning phase of an investigation is where GenAI can provide a lot of value. Whether it’s writing a SOC playbook, assigning tasks during an incident, or writing a search warrant, a plan needs knowledge and creativity to know where to find evidence. GenAI can supplement your knowledge to make sure you find the evidence.
This post walks through the 3 phases of planning and shows where a deterministic playbook is enough, and where AI provides value.
The Planning Phase
Investigations start with a set of questions that need to be answered, and the planning phase is where you turn those questions into a set of data to collect (endpoints, logs, etc.) and ideas about how to analyze the data. As an investigation progresses, you’ll learn new things and likely return to mini-planning sessions.
For example, a malware investigation may ask “Was data exfiltrated?” “Was persistence installed?” “Were credentials stolen?” To answer those, the planning process would identify data sources such as:
- Exfiltration: Process history, browser history, firewall logs, etc.
- Persistence: Triggered tasks
- Credentials: Process history, authentication logs, etc.
Planning ensures that you access and consider all possible data sources for evidence.
Playbooks: Mapping Questions to Data Ahead of Time
Because incidents have a lot of time pressure and you want consistency, many organizations will “pre-plan” by writing playbooks for common questions and scenarios. Playbooks map out what data to retrieve and what to look for.
Examples:
- SOCs have playbooks for common alerts and scenarios.
- DFIR teams have playbooks for common incident types, such as ransomware.
- Law enforcement have plans that map out what types of devices to look for during a search based on the type of crime being investigated.
When the investigation starts, you need to either find an existing playbook or make an equivalent one for this investigation.
One problem with playbooks though is that they either are very specific and can get out of date. Or they are too broad, requiring customization at use time.
3 Phases in the Planning Process
You can think of the planning process as three phases:
- Playbook search: Given the questions, does a playbook already exist that gives me a basic plan?
- Playbook creation: If not, make a basic plan based on the questions.
- Playbook customization: Make the plan specific by specifying known IPs and the current environment.
For example, a SOC analyst may find a playbook in their SOAR, and specific hostnames get added to the template. Or, if a playbook doesn’t exist, then a plan will be made from scratch.
Tool Options for Planning
As we covered in our previous post, investigators have 4 basic options for each kind of task, such as the 3 above:
- Manual: The investigator’s own knowledge and effort.
- Validated, deterministic tool: Established, community-tested tooling.
- Non-validated, deterministic tool: Existing tool with little track record.
- Direct GenAI output: GenAI does the task and decides how.
Let’s look at the 3 steps and see which approaches make the most sense.
Playbook Search Phase
This phase would find a playbook based on the investigation questions.
- Deterministic tools win when keywords from the questions match the playbook text. For example, using OpenSearch or another similar search in your SOAR.
- AI wins when the keywords don’t exactly match. For example, pointing AI at your folder of playbook files and asking it to find a relevant one.
| Manual | Validated, Deterministic Tool | Non-Validated, Deterministic Tool | Direct GenAI Output | |
|---|---|---|---|---|
| Feasibility | Yes. Investigators can review a set of them. | Yes. If the right keywords are used. | Yes. If the right keywords are used. | Yes and could find playbooks that have different keywords. |
| Time: Prepare | Low | Low | Low | Low |
| Time: Perform | Med. Depends on how many playbooks there are. | Low | Low | Low |
| Time: Verify | Low | Low | Low-Med | Med. Confirm the mapping it found is actually relevant |
| Cost | Labor | License | License | Tokens, low |
| Creativity | Some. If the question uses different keywords than the playbook. | None | None | Some. If the question uses different keywords than the playbook. |
| Defensibility | Low-Med. Depends on how many you have. | High | Med | Med |
Playbook Creation Phase
This phase maps a question to its data sources, either during playbook creation or when the investigation starts.
- Deterministic tools don’t exist for this phase because they, by definition, would need something to have provided them the mapping ahead of time
- AI and humans together can be a good fit here because AI brings in vast knowledge about how to approach the problem.
| Manual | Validated, Deterministic Tool | Non-Validated, Deterministic Tool | Direct GenAI Output | |
|---|---|---|---|---|
| Feasibility | Yes, bounded by experience | None | None | Yes |
| Time: Prepare | High | N/A | N/A | Low |
| Time: Perform | High | N/A | N/A | Low |
| Time: Verify | Low | N/A | N/A | Med — review coverage/logic |
| Cost | High (labor) | N/A | N/A | Tokens, low |
| Creativity | Depends on seniority | N/A | N/A | Potentially high |
| Defensibility | High if senior, weaker if junior | N/A | N/A | Reasonable — a candidate list, not a conclusion |
Customization Phase
This phase adapts the general playbook to this incident. It could be as simple as entering an IP address to investigate. Or it may involve identifying which EDR is being used in that part of the network, and that information may not be well documented.
- Deterministic wins if everything is clearly documented, configured, and mapped out.
- AI can be beneficial when deciding what systems are applicable in a given network.
| Manual | Validated, Deterministic Tool | Non-Validated, Deterministic Tool | Direct GenAI Output | |
|---|---|---|---|---|
| Feasibility | Yes | Yes, for simple substitution | Yes, for simple substitution | Yes, for substitution and querying other systems if additional data is needed. |
| Time: Prepare | Low | Low | Low | Low |
| Time: Perform | Med — checking relevance by hand | Low | Low | Low |
| Time: Verify | Low | Low | Low-Med | Medium. Especially if the AI used other sources to fill in unknown details. |
| Cost | Labor | License | License | Tokens, low |
| Creativity | Some. They can reason about what to use and what is out of date. | None | None | Some. They can reason about what to use and what is out of date. |
| Defensibility | High | High | Med | Med |
Conclusion
AI has a clear advantage during the Playbook Creation process because there are no deterministic tools. During the other phases, deterministic tools can be effective if the right keywords are used and they are properly maintained. But, AI can be a great fallback to find non-exact match playbooks and to resolve information when not everything is documented.
For organizations looking to use more AI, planning is an easy way to start with because it doesn’t need any of your sensitive data. You can create a folder with your playbooks and point your AI tools at it. Then ask AI to find the playbook for your questions.
Our Cyber Triage tool uses deterministic approaches to planning. It focuses on data and analytics common to intrusion investigations, and those are automatically collected and analyzed for you to review. It has a built-in playbook. We’ll be expanding its support for using AI during planning in future releases, but you can try its automated collection and analysis with a 7-day eval here.