AI-driven Investigation

From telemetry to verified conclusions.

CyberBrain applies machine learning at every stage to turn real-time network activity into one ticket. The AI Investigator then explains what happened and what to do next.

Schedule a Demo Take a Product Tour

AI Investigator · case 4b7e19d2● investigating

Telemetrylive · east-west

··:··:··10.0.4.31 → 142.250.72.196:443tls
··:··:··10.0.4.12 → 10.0.1.5:53dns
··:··:··10.0.9.2 → 10.0.1.20:445smb
··:··:··10.0.4.40 → 20.190.159.68:443tls
··:··:··10.0.12.7 → 10.0.12.1:502modbus
··:··:··10.0.4.40 → 13.107.42.14:443tls
··:··:··10.0.1.5 → 91.189.91.157:123ntp
··:··:··10.0.4.22 → 10.0.1.5:53dns
··:··:··10.0.9.14 → 10.0.9.8:2049nfs
··:··:··10.0.4.31 → 104.18.32.115:443tls
··:··:··10.0.1.20 → 10.0.4.12:445smb
··:··:··10.0.12.9 → 10.0.12.1:502modbus
··:··:··10.0.4.62 → 10.0.1.5:53dns
··:··:··10.0.4.55 → 10.0.1.30:3389rdp
··:··:··10.0.4.31 → 142.250.72.196:443tls
··:··:··10.0.4.12 → 10.0.1.5:53dns
··:··:··10.0.9.2 → 10.0.1.20:445smb
··:··:··10.0.4.40 → 20.190.159.68:443tls
··:··:··10.0.12.7 → 10.0.12.1:502modbus
··:··:··10.0.4.40 → 13.107.42.14:443tls

Ticket tk-07listening

01Sweep: 14 hosts on tcp/445
02Fan-out: 3 new peers
03C2 to 198.51.100.74:8443
04Channel cut at the firewall

AI Investigatorwaiting for a ticket

Likely real threat: sweep, fan-out, C2

Discovery, lateral movement and command-and-control, inside ten seconds.

confidence0.00

Next: contain 10.0.4.17 and 10.0.4.26; check 10.0.4.23 and 10.0.4.29.

✓ mitigation held11.2k tokens · $0.04

How CyberBrain rebuilds the attack story within seconds.

Purpose-built machine learning runs throughout CyberBrain, from models in the network probes and endpoint agents that map the attack in seconds, to the AI Investigator that writes your analyst's readout.

Where the model runs

Probes & agents
CyberBrain
AI Investigator

01 · Read the network as it happenscase 9f31c204

probe · mirror portagentWinRM to a new peerport-forward openedrelays out

Conversationsexact timing kept

ws-fin-07 ↔ build-02

remote session

build-02 ↔ nas-backup

sudden burst

nas-backup → 198.51.100.74

beaconing · every 60 s

4 hops · internal to internet · one chain connects

steady routine · no alertsteady routine · no alertunexpected · added as context

Ticket tk-01 · 4 devices, in ordercritical

0102:14:09ws-fin-07 → build-02WinRM, first contact
0202:14:31build-02port-forward 0.0.0.0:9443
0302:14:33build-02 → nas-backuprelay, unmanaged peer
0402:47:52nas-backup → internetegress, TLS unverified

Enriched by your security stack

+ Threat intel: registered 9 days ago+ Reputation 0.91+ Asset: unmanaged NAS+ EDR: 2 hosts, 5 processes

AI Investigator · written investigationdone

Summary: A four-hop C2 tunnel from 10.0.4.17 out to 198.51.100.74.
Observed facts: Five, each linked to the evidence behind it.
Hypothesis: Hands-on-keyboard C2 relayed through built-in tools.
Confidence: 0.91 · high
Next actions: Contain two hosts, segment the NAS, hold the block.

01/06Probes & agentsCyberBrainAI Investigator

01Probes & agents
Read the network as it happens
Lightweight models run inside the Nodal probes and agents, analyzing traffic as it streams live and detecting attacker behaviors on the spot, with no waiting for logs to be collected, shipped and indexed.
Why machine learning
Attackers vary their tools and timing to slip past fixed signatures. Models recognize behavior itself, even when the details change.
02Probes & agents
Record every conversation in time
Live traffic becomes compact time series of device-to-device conversations that preserve the exact timing, so any system and identity activity can be matched to the network conversations around it.
Why machine learning
Timing is evidence: regular beaconing, remote sessions, sudden bursts of traffic, pivoting across subnets. Learned time series keep the signal without storing every packet in expensive packet stores.
03CyberBrain
Map the path across every hop
CyberBrain follows communication across multiple nodes, whether the attack stays internal or reaches the internet. Threat hunters see the attack path in seconds instead of rebuilding it by hand.
Why machine learning
With every extra hop, the number of possible paths multiplies. Searching them one by one is too slow. Models pick out the chains that actually connect, at machine speed.
04CyberBrain
Learn the network routine
Many tools treat anything new as suspicious, so unusual but harmless events become alerts that take time to verify. CyberBrain uses learning differently: it recognizes infrastructure devices with a steady routine, like firewalls and network equipment, so their normal activity doesn't raise false alarms, and it adds what's unexpected to the investigation as context.
Why machine learning
Novelty shouldn't raise an alert on its own, but it adds weight to behavior detections, so your SOC keeps the weak signals that point to the costliest attacks.
05CyberBrain
Incidents as one ticket, enriched
As the attack unfolds, CyberBrain joins behaviors and conversations across peer devices, in the order they happened, with each device's history, into a single ticket. Integrations with your security stack enrich it with threat intelligence, reputation data, asset context and other signals.
Why it matters
Analysts get one place to see the whole attack, not dozens of disconnected alerts to piece together across consoles.
06AI Investigator
Analyze, summarize, and guide
The AI Investigator turns the ticket into a written investigation: summary, observed facts, hypothesis, confidence and recommended next actions.
Why it matters
Your analysts start with actionable conclusions they can verify, not raw evidence they have to interpret.

Sample investigation

Conclusions to verify, not evidence to interpret.

A simulated AI Investigator readout for a multi-hop intrusion: the five parts of every investigation, each one traceable to the evidence behind it.

1Summary
2Observed facts
3Hypothesis
4Confidence
5Next actions

AI Investigator · ticket tk-01 · case 9f31c204● investigation complete

Critical

Likely real threat: multi-hop C2 tunnel

1Summary

Summary

An operator at 198.51.100.74 is driving a four-hop path into the network: 10.0.4.17 to 10.0.4.62 to 10.0.9.8, then out on tcp/8443. Every step uses tools the hosts already carry, and the hop carrying the volume runs on an appliance that cannot host an endpoint agent.

2Observed facts

Observed facts

02:14:09WinRM from 10.0.4.17 to 10.0.4.62: the first contact ever seen between these hostsnetwork
02:14:31Root ssh port-forward on 10.0.4.62, launched from a directory posing as a systemd tmpdirEDR
02:47:52POST from 10.0.9.8 to 198.51.100.74:8443 with TLS verification disablednetwork
06:26:411.9 GB relayed across the third hop in 4 h 12 m, over 47 sessionsnetwork
06:26:41198.51.100.74 was registered nine days ago and scores 0.91 for alertsthreat intel

3Hypothesis

Hypothesis

Hands-on-keyboard command-and-control, relayed through the systems' own tools. No single binary is malicious; the sequence is: WMI spawns a staged DLL, the DLL spawns encoded PowerShell, PowerShell opens WinRM to a new peer, and that peer forwards to an appliance nobody is watching. Endpoint AV is clean on both managed hosts, as it would be.

4Confidence

Confidence

0.91High

Network evidence91
Endpoint corroboration68
Threat intelligence91

5Next actions

Next actions

Contain 10.0.4.17 and 10.0.4.62 through the EDR
Segment 10.0.9.8 at the switch: it cannot run an agent
Preserve /var/tmp/.systemd-private-6f2a91/ before a reboot clears it
Keep the block on 198.51.100.74:8443 and check who registered it

Simulated readout. The scenario is invented, and the addresses are documentation ranges.

Bring your own LLM

Bring your own AI model. Govern your data.

Your incident data stays under your control. Connect your account with a frontier AI provider, or run an open-weight model on your own infrastructure. CyberBrain configures the AI Investigator for you, with an investigation method built for network evidence, so it's ready to work without prompt engineering on your side.

Under your control

Your network

Probes and agents

CyberBrain

Evidence, correlation, one ticket

incident data

AI Investigator

Configured for network evidence

✓ No prompt engineering on your side

your account

Frontier AI provider

Connected with your account

AI spend control

AI spend you can predict.

Not every ticket needs a language model.

28.5% of this month's raised tickets have been analyzed by your selected language model.

$8.67of $20.00 this month

↗ $3.52 ahead of pace

Cumulative spend
Budget pace
Projected, paced

28.5% · Investigated by your model100% · Every ticket: detection, correlation and evidence, at no token cost

01
The detection, correlation and evidence behind every ticket come from CyberBrain's own models, at no token cost, so the full evidence is always there, even when the AI Investigator isn't used.
02
CyberBrain then prioritizes the tickets that warrant investigation and paces them against the monthly budget you set in dollars.
03
Because the AI Investigator reasons over evidence that's already structured, not raw logs, each investigation uses fewer tokens. Your AI budget pays for answers, not for a language model sifting through packet stores and data lakes.