Tool integration
The tool families
The Uncover phase touches fourteen major tool families. Each has a distinct role, capabilities, and limitations. The methodology asks the analyst to learn the question-to-tool mapping deliberately rather than running every alert through the same SIEM query.
🔎 SIEM
Centralized log search and correlation. The investigation’s primary query window.
💻 EDR
Process trees, command lines, on-host containment.
🧩 XDR
Vendor-stitched correlation across endpoint, identity, email, cloud.
🪪 ITDR
Attacks on the identity plane: directories, IdPs, tokens, sessions.
🌐 Network analysis
Wire-level observation. Catches what endpoint cannot.
🧠 Threat intelligence
Enrichment and hypothesis generation.
🍯 Deception
Anything that touches deception is suspicious by definition.
🔬 Digital forensics
Deep host analysis for confirmed cases.
💣 Sandbox / detonation
Run the suspicious thing safely and watch what it does.
🛡️ Vulnerability scanners
What is exposed and what is patched.
🤖 SOAR
Playbook execution and triage automation.
☁️ CSPM
Cloud misconfiguration and exposure visibility.
⚡ CDR
Runtime cloud detection: control-plane and workload activity, live.
🏞️ Data lake
Scalable retention and ML-friendly analytics.
SIEM
Security Information and Event Management systems function as the nerve center for Security Operations The people, processes, and technology responsible for monitoring, detecting, investigating, and responding to security threats within an organization. , centralizing the collection, storage, and analysis of event data across the Infrastructure The systems, networks, and services that computing runs on. In triage the word points two directions: the organization's infrastructure is what alerts fire on, and attacker infrastructure is the set of C2 servers, domains, and staging hosts an adversary operates, which pivoting on indicators is meant to map. . SIEMs enable both real-time detection and retrospective investigation through correlation, anomaly detection, and customizable alerting.
✓ Key capabilities
- Log collection and storage across firewalls, IDS/IPS, OS, auth services, cloud, applications.
- Data analysis and alerting via rule-based and behavioral analytics.
- Cross-source correlation exposes multi-stage attacks and coordinated activity.
- Reporting and dashboards for compliance, threat hunting, and operational monitoring.
✗ Common limitations
- Retention constraints bounded by licensing and infrastructure capacity.
- Coverage gaps when log sources are unsupported or misconfigured.
- Operational complexity for rule tuning, parsing, and normalization.
- Cost overhead at enterprise scale for licensing and infrastructure.
When SIEM is the first stop
SIEM’s strength is cross-source correlation. When an investigation needs to know “did this happen anywhere else?” or “what other systems did this User The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise. touch?”, the SIEM is the primary tool. It is less useful for deep single-source Forensics The application of scientific methods to collect, preserve, and analyze digital evidence for security investigations and incident response. , which is where EDR and Digital Forensics The analysis and examination of digital evidence to investigate and solve crimes or security incidents. earn their keep.
EDR
Endpoint A device that initiates network connections and runs user-facing software: laptop, desktop, server, phone, tablet. Endpoints are where most adversary tradecraft eventually shows up, which is why EDR exists. Detection and Response platforms provide high-fidelity Telemetry Collection and transmission of security-relevant data from remote sources for monitoring and analysis. and response capabilities directly on user devices and servers. EDR monitors process Execution The attacker successfully runs malicious code on a system, typically using interpreters, scripts, payloads, or legitimate tools. , file system activity, memory use, and network connections to detect malicious activity at the endpoint level.
✓ Key capabilities
- Process monitoring: creation events, command-line parameters, parent-child lineage, runtime patterns.
- Network monitoring: outbound connections, DNS, protocol behavior, detecting C2 and exfiltration.
- File activity tracking: unauthorized modifications to system files and critical directories.
- Response actions: endpoint isolation, memory forensics, process termination, automated remediation.
✗ Common limitations
- Visibility gaps on non-standard endpoints (IoT, ICS, specialized hardware).
- False-positives from behavioral detection misclassifying legitimate admin work.
- Resource demands for tuning, alert triage, and deep forensic investigation.
- Cost and infrastructure at scale, especially with diverse endpoint types.
XDR
Extended Detection and Response platforms grow the EDR model outward: endpoint, identity, email, network, and cloud telemetry land in one console, and the vendor’s correlation logic stitches related events into a single incident before an analyst opens it. Where a SIEM joins whatever you feed it using rules you wrote, XDR ships pre-built joins across the telemetry the vendor controls.
✓ Key capabilities
- Cross-domain incident stitching: the phishing email, the process it spawned, and the sign-in it enabled arrive as one incident, not three alerts.
- Unified query surface across endpoint, identity, and email telemetry without per-source query languages.
- Coordinated response actions: isolate the host, revoke the session, and purge the email from one place.
- Less swivel-chair triage because the joins the analyst would run by hand are pre-computed.
✗ Common limitations
- Correlation quality tracks ecosystem coverage: strongest on the vendor’s own sensors, weakest on third-party sources.
- Opaque stitching logic: the platform asserts that events belong together; the analyst still verifies the join keys before trusting the story.
- Vendor lock-in deepens with every telemetry type routed through one platform.
- SIEM overlap creates ambiguity about which system is authoritative for a given question.
XDR automates the join, not the judgment
An XDR incident is a machine-built version of the correlation this chapter teaches by hand: the same join keys, applied automatically. That makes it a head start, not a verdict. When the stitched incident matters to the outcome, check the joins the way you would check your own.
ITDR
Identity Threat Detection and Response tools watch the identity plane itself: directories, identity providers, and the credentials, tokens, and sessions they issue. As attacks shift from breaking endpoints to logging in, ITDR covers the tier where Token Theft Unauthorized acquisition of authentication tokens from memory or storage, enabling attackers to impersonate legitimate users. and Session Hijack Taking over an active session by stealing or guessing session tokens or cookies, bypassing authentication. live and where EDR has no view.
✓ Key capabilities
- Directory attack detection: Kerberos A network authentication protocol using tickets to allow secure identity verification. ticket abuse, DCSync-style replication requests, suspicious privilege grants.
- Token and session anomalies: replayed tokens, impossible-travel sessions, MFA-bypass patterns at the IdP.
- Attack-path mapping showing which identities and delegations lead from a foothold to the crown jewels.
- Identity-native response: revoke sessions, force reauthentication, disable accounts at the provider.
✗ Common limitations
- Coverage bound to integrations: an IdP or directory the tool does not ingest is an identity blind spot.
- Service-account noise in automation-heavy environments demands careful baselining.
- Posture findings blur with live attacks: a risky delegation and an active abuse of it arrive in the same queue.
- Revocation gaps: long-lived tokens already issued to third-party SaaS can outlive the response action.
Network analysis
Network analysis tools provide packet-level and flow-level visibility into communication patterns. Essential for detecting Lateral Movement Adversary traversal from the initial-access host to other hosts inside the environment. Each hop expands the blast radius and adds new entities for Subject analysis. Often piggybacks on legitimate authentication, which is what makes it hard to detect. , Exfiltration The unauthorized transfer of data from a system or network, often as part of a data breach or espionage operation. , C2 Network Traffic The data moving between hosts on a network, observed as connections, flows, and packets. In triage, traffic metadata (who talked to whom, when, how much, and over which port and protocol) is often the fastest way to confirm or rule out command and control, exfiltration, or lateral movement. , and Protocol The agreed set of rules two systems use to communicate: HTTP, DNS, SMB, RDP. In triage the protocol tells you what a connection is capable of doing, and a mismatch between the protocol and the port it runs on is a classic tell for tunneling or evasion. misuse, especially in environments with unmanaged devices or systems that cannot support EDR.
✓ Key capabilities
- Traffic inspection for anomalies in behavior, volume, and flow direction.
- Protocol decoding across DNS, HTTP, SMB, and others to uncover misuse.
- Deep packet inspection for embedded threats, file transfers, encrypted tunneling.
- Visualization tools for traffic patterns and threat propagation.
✗ Common limitations
- Scalability challenges in high-volume environments that overwhelm capture infrastructure.
- Protocol limitations with proprietary or encrypted communications.
- Operational complexity requiring tuning and specialized networking expertise.
- Cost considerations for licensing, storage, and packet-capture retention.
Threat intelligence platforms
TIPs consolidate external Threat An actor (or capability) with intent and means to cause harm. A vulnerability is what they exploit. Classical risk models multiply threat, vulnerability, and impact; ASSURED's RATM folds the threat and vulnerability questions into likelihood, so risk stays impact times likelihood. data and provide critical context for IOCs, attacker infrastructure, and adversary tactics. Integrating TIP Intelligence Information gathered and analyzed to understand and predict potential security threats. enhances posture, accelerates detection, and improves triage by correlating internal events with known external threats. This is the platform view; the methodology for using what it serves is the threat-intelligence pillar, and the feed-as-evidence view is in data sources.
✓ Key capabilities
- Feed aggregation across commercial, OSINT, ISAC, and government sources.
- IOC enrichment linking observed indicators to actors, campaigns, malware families.
- TTP analysis mapped to MITRE ATT&CK for shared vocabulary.
- Reporting and dashboards for strategic and tactical intelligence.
✗ Common limitations
- Feed quality varies dramatically across vendors and OSINT sources.
- Integration challenges with SIEM, EDR, and orchestration platforms.
- Analyst workload from redundant data and insufficient context.
- Resource requirements for premium subscriptions and operational tooling.
Deception technologies
Deception platforms (Canary, Proofpoint Identity Threat Defense (formerly Illusive), Commvault ThreatWise (formerly TrapX)) flip the asymmetry. Decoy assets, fake credentials, deceptive files, and simulated services have no legitimate business use; interaction with them is high-confidence evidence of malicious activity.
✓ Key capabilities
- Decoy deployment tailored to mirror the organization’s unique assets.
- Attack engagement capturing command execution, lateral movement, attacker tools.
- Alert fidelity approaching zero false-positives because legitimate users do not touch decoys.
- Threat-actor profiling via collected behaviors and metadata.
✗ Common limitations
- Deployment scope matters; sparse coverage lets sophisticated attackers bypass.
- Operational complexity to avoid disrupting legitimate operations.
- Alert dependency: deception only fires when attackers engage decoys.
- Maintenance overhead to keep decoys believable as production evolves.
Digital forensics
Digital forensics tools enable comprehensive analysis of compromised systems. Recovery, artifact extraction, timeline reconstruction, chain-of-custody preservation. In the tier model this is specialist work, typically owned by Tier 3 or a dedicated forensics function once a case has escalated; the triage analyst’s forensics decision is usually narrower and earlier, preserving the evidence (image before reimage, capture memory before reboot) so that deep analysis stays possible.
✓ Key capabilities
- Disk and memory analysis recovering deleted content, extracting artifacts, identifying injected DLLs and shellcode.
- Timeline reconstruction via correlation across system logs, registry, file metadata, user activity.
- Artifact extraction isolating browser history, auth events, persistence mechanisms.
- Chain of custody via cryptographic verification and documentation rigorous enough for legal proceedings, a bar set by counsel and the forensics team when a case may go to court, not a default the triage queue carries.
✗ Common limitations
- Resource intensity requires significant computing resources and skilled personnel.
- Reactive application retrospective by nature, not useful for real-time detection.
- Environmental constraints optimized for specific OSes and file systems.
- Operational overhead from premium licenses and specialized expertise.
Sandbox and detonation
Detonation services run a suspicious file or URL inside an instrumented, disposable environment and record everything it does: the process tree it builds, the domains it calls, the files and registry keys it writes. Sandboxing Detonating an unknown file or URL inside an isolated environment to observe what it does. Mature malware checks for sandbox-typical signals (small disk, brief uptime, no mouse activity, suspicious driver names) and stays dormant until it sees a real host. turns “is this attachment malicious?” from a signature lookup into an observed-behavior question, and its report feeds the timeline directly.
✓ Key capabilities
- Behavioral verdicts on unknowns: samples with no signature history still reveal themselves by what they do.
- IOC extraction: C2 domains, dropped-file hashes, and mutex names from the run become pivots back into the environment’s own telemetry.
- Safe URL analysis for phishing triage without touching the link from a production machine.
- Report artifacts (process trees, network captures, screenshots) that drop into the investigation record.
✗ Common limitations
- Evasion is a built-in adversary feature: time delays, environment checks, and required user interaction exist precisely to beat detonation.
- A clean run is weak evidence of benign. It means the sample did nothing in that environment during that window, nothing more.
- Targeted samples keyed to the victim’s domain, language, or geography may refuse to run anywhere else.
- Submission constraints: file-type and size limits, and data-handling policies for sensitive documents.
Vulnerability scanners
Vulnerability A defect in a system that can be turned into adversary capability if paired with an exploit and exposure: an unpatched CVE, a misconfiguration, a default credential, a logic flaw. Vulnerability without exposure or exploitability is latent; with both, it's a finding. scanners systematically assess systems, applications, and configurations to identify known weaknesses. They enable analysts to determine exploitability and correlate vulnerabilities with observed threat activity.
✓ Key capabilities
- Asset discovery and fingerprinting for comprehensive inventory.
- Vulnerability identification against CVE databases and misconfiguration checks.
- Risk scoring and prioritization using CVSS plus exploitability and asset criticality.
- Remediation tracking via dashboards and verification of applied patches.
✗ Common limitations
- False-positives particularly in complex or customized environments.
- Disruption risk from active scans against sensitive systems.
- Limited detection of unknowns (zero-days, novel misconfigurations).
- Snapshot-based visibility rather than continuous monitoring.
SOAR
Security Orchestration, Automation, and Response platforms integrate disparate tools, data sources, and response actions into a unified workflow. They accelerate handling through automation and ensure consistent, repeatable processes that reduce analyst cognitive load.
✓ Key capabilities
- Playbook automation for triage, enrichment, false-positive elimination, containment.
- Tool integration aggregating SIEM, EDR, threat intel, ticketing, and network tools.
- Case management with collaboration, task assignment, and evidence tracking.
- Real-time response for host isolation, firewall changes, account suspension.
✗ Common limitations
- Playbook maintenance burden as tools and processes evolve.
- Onboarding complexity for integration via APIs and custom workflows.
- Alert fidelity dependency on incoming alert quality.
- Analyst overreliance risking erosion of situational awareness.
CSPM
Cloud Security Posture Management tools continuously assess AWS, Azure, GCP environments for misconfigurations, policy violations, and compliance risks. Essential for identifying exposures in dynamic, multi-account cloud infrastructures.
✓ Key capabilities
- Misconfiguration detection across IaC, runtime configs, and account settings.
- Compliance mapping against CIS, NIST, ISO benchmarks with dashboards.
- IAM analysis highlighting privilege escalation paths and public exposure.
- Drift detection alerting on unauthorized configuration changes.
✗ Common limitations
- Blind spots in proprietary services and ephemeral assets (containers, lambdas).
- Overwhelm from low-severity issues requiring triage to avoid fatigue.
- Remediation limitations requiring integration with deployment pipelines.
- Cloud-specific tuning as APIs and services differ across providers.
CDR
Cloud Detection and Response covers what CSPM cannot: live activity. Where CSPM reads static configuration, CDR watches the control plane ( AWS CloudTrail Records and logs API activity within an AWS account, the audit trail for security and forensic work. and its Azure and GCP equivalents) and workload runtimes for attacks in progress: unusual API sequences, role chaining, containers spawning shells they never spawn.
✓ Key capabilities
- Control-plane anomaly detection: API-call sequences, role assumptions, and key usage that break the account’s baseline.
- Workload runtime sensors for container and serverless behavior that agentless posture tools never see.
- Identity-to-workload correlation tying a suspicious role session to the resources it actually touched.
- Cloud-native response: revoke keys and sessions, quarantine workloads, snapshot disks for forensics before the evidence recycles.
✗ Common limitations
- Ephemeral evidence: the container that ran the payload may be gone in minutes; capture has to be part of the detection path.
- Provider API coverage gaps in newer or niche services limit what can be observed at all.
- Multi-cloud inconsistency: detection depth varies by provider, so identical attacks surface differently.
- Noisy baselines in environments where infrastructure legitimately changes constantly.
CSPM vs CDR in one line
CSPM answers “what could go wrong here?” from configuration. CDR answers “what is going wrong right now?” from activity. An Uncover investigation of a cloud alert usually needs the second and consults the first for context.
Security data lakes
Centralized repositories that ingest, store, and manage large volumes of structured and unstructured security data. By consolidating logs, alerts, network flows, endpoint telemetry, and Threat Intelligence Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, implications, and actionable advice. , data lakes enable advanced analytics, correlation, and long-term retention critical for sophisticated investigations.
✓ Key capabilities
- Scalable ingestion and storage for diverse formats (JSON, CSV, XML, binary).
- Schema-on-read flexibility without upfront schema definition.
- ML and analytics integration for anomaly detection and behavior modeling.
- Cross-source correlation across endpoint, network, cloud, and external feeds.
- Historical retention for retrospective analysis and compliance reporting.
✗ Common limitations
- Data normalization challenges requiring engineering resources.
- Query performance variability without proper indexing.
- Management complexity for governance, security, access control, cost.
- Skill requirements in data engineering, analytics, and scripting.
Choosing the right tool for the question
The pattern is always the same.
Start with the question. What does the analyst actually need to know? “Did this binary run?” “Did this user authenticate to that system?” “Where did this traffic go?“
Identify which tool category can answer it. EDR for process execution. Identity logs for authentication. Network analysis for traffic destination. The mapping is mostly memorized over time.
Plan the query order. If the answer requires multiple sources, run the cheapest or most specific query first. SIEM queries that scan everything can wait until the EDR query has narrowed the window.
Document tools and queries used. Audit trail matters for the handoff to Risk, for detection engineering feedback, and for compliance review later.
Key Takeaway
Tools serve the question, not the other way around. Strong analysts learn the question-to-tool mapping deliberately and reach for the right one at the right step. Weak analysts run the same SIEM query against every alert and hope. The methodology asks for the deliberate choice every time.
Next up
Uncover working example
A walkthrough of the Uncover phase applied to the bounded investigation Scope handed off.
See the example