Identifying relevant intelligence is only the beginning. Someone still needs to check existing coverage, select the right telemetry, prepare a query, establish its scope and connect the outcome to an investigation. Each handoff can lose context or leave useful intelligence waiting in a queue.
Comprehensive Auto Triage connects those steps in Threat Foundry. An explicit tenant policy moves eligible intelligence through a bounded workflow around the customer’s existing security tools, carrying its source evidence and authorization into the resulting work.
Start with a policy the team understands
Automation should have an operating scope. The tenant chooses the eligible sources, execution connection, limits and permitted workflow. Source permissions and currentness are checked alongside the policy; a high priority score does not supply missing authority.
This makes Comprehensive Auto Triage distinct from a notification that merely tells an analyst to investigate. The policy defines which steps may actually run and the limits within which they run. Budgets, time windows and emergency pause remain part of that operating decision.
Connect the intelligence to the work
- Select eligible intelligence. Start from source evidence and the current assessment, retaining markings, provenance and review context.
- Inspect coverage. Consider existing detection and hunting evidence before deciding what additional work is useful.
- Prepare and validate the query. Bind the intended behavior to the supported provider, telemetry and allowed query scope. Required human review remains a separate decision.
- Run bounded read-only work. Apply the authorized time window, source restrictions and execution limits.
- Retain the outcome. Carry observations, limitations and the handoff into Triage or an eligible Detection Chains investigation.
The sequence connects prioritization to evidence collection. It does not turn an imported report, generated query or queued job into a completed investigation.
Give machine learning a useful role
Unified CTI ML helps assess association, material change, relevance and actionability. It can help reviewers identify intelligence worth pursuing and distinguish substantive changes from repeated reporting.
The automation policy then supplies the authority for permitted work. Keeping these responsibilities clear lets a team improve prioritization without silently expanding what an automated job is allowed to do. Model output supports a decision; the current policy, evidence and workflow state determine which action can proceed.
Continue into multistage attack detection
Some intelligence describes a sequence rather than one isolated behavior. An eligible multistage profile can enter the shared Detection Chains workflow through Auto Triage, connecting ordered observations using explicit entity identities and time windows.
The investigation can then evolve as stage evidence arrives. Source lineage and the authorization behind the entrypoint stay available. The same engine supports eligible saved-hunt work, so analysts can move between intelligence-led automation and investigation without constructing a separate correlation process.
Read how Detection Chains preserve the sequence and its evidence.
Make incomplete work useful to the next analyst
A provider error, missing telemetry, exceeded limit or partial result deserves an explicit state. It should not be converted into a clean result to make a dashboard look complete. Recovery should preserve the existing investigation and completed evidence while recording what remains unresolved.
That distinction also matters when a query returns no observations. The team still needs to understand the performed checks, time range and suitability of the telemetry before drawing a conclusion.
Put the workflow beside your existing tools
Threat Foundry connects intelligence, hunting and investigation around the security platforms the customer operates. Provider-native mappings, permissions and prerequisites remain specific to each execution path. Preparing detection content, running a read-only hunt and deploying a rule are separate operations.
For enterprise teams, Comprehensive Auto Triage connects recurring intelligence work to their investigation process. For MSPs and MSSPs, the same workflow can operate within isolated customer tenants, with the customer’s policy and evidence boundaries preserved.
Explore the connected product workflow, or discuss a scoped Auto Triage use case.