Skip to main content
ORDRANISecurity

AI-assisted investigation

From scattered events to one explainable case.

Ordrani replaces a stream of isolated anomaly alerts with one case per threat — assembled from the evidence, prioritized by consequence, and written so that an analyst can act on it.

Overview

An investigation, not an alert.

A role enumeration in AWS, a secret read four minutes later, a policy change on an unrelated role. Viewed separately, each is a low-priority anomaly. Connected through a shared identity and timeline, they describe an intrusion.

Ordrani’s investigation workspace presents that connection as a single case. It brings together the reconstructed timeline, the identity and workflow involved, the strength of attribution, the resources affected and what remains unknown.

An evidence-grounded language model drafts the narrative of each case, constrained to the events the case contains and required to cite them. It explains; it does not decide. Analysts confirm, dismiss or escalate, and those decisions feed back into detection quality.

What every case contains

  • A reconstructed sequence, ordered by event time across systems
  • The identity, workflow and execution responsible — with attribution confidence
  • The assets affected and why they matter
  • An assessment written from the evidence, including what remains unconfirmed
  • Recommended next steps, with any change to your environment held for approval

Inside a case

Everything needed to decide, in one place.

The investigation workspace brings the timeline, attribution, affected assets and assessment together.

CASE OR-0142 · OPENED 14:42 UTC

Potential workflow identity misuse

Identity prod-deploy-role · origin deploy.yml #4182

High priorityAwaiting review

Reconstructed sequence

  1. 14:32:05

    sts:AssumeRoleWithWebIdentity

    org/payments-service · environment: production

    Confirmed
  2. 14:32:41

    ecs:UpdateService

    payments-api · task definition rev 212

    Confirmed
  3. 14:33:40

    iam:ListRoles, iam:ListPolicies

    37 calls in 52 s · first observed for this identity

    EnumerationConfirmed
  4. 14:36:12

    secretsmanager:GetSecretValue

    prod/db-credentials · classified sensitive

    Sensitive accessCorrelated
  5. 14:41:50

    iam:PutRolePolicy

    inline policy added to reporting-export-role

    Privilege changeCorrelated

Assessment

A deployment identity performed role enumeration it has never performed, then a sensitive secret was read by the same role after the run completed. The sequence is consistent with credential or workflow misuse. Authorization of the run has not been confirmed.

Affected assets

  • prod/db-credentials
  • reporting-export-role
  • payments-api (ECS)

Recommended next steps

  1. 1.Confirm with the repository owner whether run 4182 was an authorized deployment.
  2. 2.Review active sessions for prod-deploy-role and their source networks.
  3. 3.Inspect the inline policy added to reporting-export-role.
  4. 4.Revoke sessions and restrict the role trust policy — requires approval.

How a case is built

From correlated signals to a human decision.

  1. 01

    Correlate

    The Temporal Identity Graph connects deviations that share an identity, session, execution or resource within a meaningful window of time.

  2. 02

    Assess

    Sequence models evaluate whether the connected events form a recognized progression, such as discovery followed by escalation and sensitive access.

  3. 03

    Prioritize

    Each case is ranked by privilege at stake, resource sensitivity, attribution strength, corroboration and change context.

  4. 04

    Explain

    The language model writes the assessment from the case’s own evidence, citing the event behind every statement.

  5. 05

    Decide

    An analyst confirms or dismisses the case and approves any response. Nothing changes in your environment without that approval.

Constraints on the AI

A language model that explains, cites and defers.

01

Bounded context

The model works only from the evidence inside a single case. It does not draw on other customers’ data or unverified outside sources.

02

Cited statements

Every statement in an assessment links to the events or baselines that support it, so any claim can be checked in one step.

03

Stated uncertainty

Where attribution is correlated rather than confirmed, or evidence is missing, the assessment says so plainly.

04

No autonomous action

The model does not close cases, change priorities or take response actions. Those decisions remain with people.

05

Detection stays structured

Detections come from the behavior, provenance and sequence models. The language model describes conclusions; it does not invent them.

06

Learns from analysts

Confirmations and dismissals are recorded and used to improve future detection and prioritization.

Continue exploring

Related reading.

See what a case could look like for your team.

We are glad to walk through the investigation workflow and discuss how it would fit alongside your SIEM and response process.

Start a conversationBack to the platform