Auto-Investigating Detections
Investigate detections as they fire, so the report is waiting when an analyst opens them
TL;DRA Fusion SOAR workflow launches a Query Worker when a detection fires. The report appears in the Query.AI panel on that detection.
The workflow ships with the app but is off until you provision it. Enabling it needs the Workflow Author role.
Every matching detection spends an agentic investigation against your Query tenant — scope the severity condition accordingly.
How It Works
Detection fires
└─ Workflow (desired conditions, such as severity)
└─ Query Worker launches, searches the mesh for several minutes
└─ Analyst opens the detection, report is already thereThe workflow launches and exits without waiting. The app records a pointer to the investigation, so the panel fetches its current state live — a run still working when it was recorded shows its finished report as soon as it is ready.
Choosing the Trigger
The shipped sample workflow "Query worker auto-investigate" uses the Detection > EPP Detection trigger but is disabled by default. Falcon severity runs 1–5. The shipped sample condition filters to High and Critical. Adjust the condition in the Fusion condition builder. Customize it to restrict what Detections should launch a worker investigation and then enable it. Weigh volume against value: every match launches an investigation, and informational detections rarely justify one.
Next-Gen SIEM → Detections is a mixed list — endpoint detections alongside NG-SIEM's own. The integration supports the former and not the latter, which can look inconsistent.
What the Analyst Sees
The Worker Investigation tab shows the report, with a link to the full Worker interface in Query where every step and piece of evidence is available.
The panel states where the investigation came from — started automatically when the detection fired, or started by an analyst. If the Worker is still running, the panel shows its status and updates in place.
Investigations accumulate rather than overwrite. The newest is shown by default; a selector gives access to earlier ones, so a colleague opening the detection tomorrow sees what has already been tried.
Checking It Works
Open the workflow in Fusion SOAR and review its execution history. Each firing appears as an execution with its trigger payload and action output.
A successful launch returns an investigation identifier and console link within a second or two — that is the launch succeeding, not the investigation finishing.
If executions appear but no report does, check that the Query Workers API integration has a valid token.
Capacity
Before enabling, check your recent detection volume at the conditions you intend to cover. Start narrow and widen after a week of real volume. The workflow can be switched off at any time without uninstalling the app or losing recorded investigations.
Investigations take minutes, not seconds — that time is spent right after when the alert is triggered rather than while an analyst waits.
What's Next
Updated about 2 hours ago