A threat surfaces in the SOC. The analyst investigates it, liaises with the client to gather the required context, reaches a conclusion, and then closes the alert. The analysis is complete, but it has also generated valuable knowledge about the client's environment.
What happens to this knowledge when a similar scenario occurs a few weeks later?
With the Use Case feature in Reveelium v12.5, insights gained from a previously analyzed and qualified threat can now be capitalized upon and leveraged during future analyses.
Transforming a closed threat into actionable knowledge
With Reveelium v12.5, an identified, qualified, and closed threat can be tagged as a Use Case directly from its details view.
The timing of this action is critical. Upon closure, the investigation is complete, the conclusion is established, and the client context has been gathered. All the necessary information is thus assembled to immediately capitalize on the work performed. The tag can be applied by the SOC team, or directly by the client. Indeed, when faced with technical behavior, each party holds part of the puzzle: the analyst knows what occurred across the IS; the client can explain why.
Unusual activity may therefore stem from scheduled maintenance, a new tool deployment by the IT department, or regular operations by a service provider. The intersection of these two perspectives—the SOC's technical expertise and the client's operational knowledge—is what gives Reveelium Use Cases their full value.
What does a Use Case actually contain?
A Use Case brings together the elements that enabled the threat to be understood and qualified:
- the observed technical scenario;
- associated signals and alerts;
- the timeline of events;
- the analysis conducted by the SOC engineer;
- the final conclusion reached;
- the client's operational context and feedback;
- communications exchanged throughout the analysis.
Each new Use Case enriches a knowledge base built from real-world situations that have already been investigated and contextualized. The challenge is no longer merely to retain threat history, but to make the knowledge generated during remediation truly actionable.
Shared knowledge empowering both analysts and the Copilot
This feature addresses two complementary use cases.
For SOC analysts: no longer starting from scratch
When faced with a situation similar to a previously encountered case, the analyst has a reference point: what was observed, the analysis performed, the conclusion reached, and the context provided by the client. They can thus rely on established knowledge and focus their investigation on what is genuinely new, rather than searching for information already gathered during a prior analysis.
This capitalization also streamlines onboarding for new analysts within an environment. They can review previously handled situations and their specificities without having to gradually piece this knowledge together alert by alert.
For the LLM Copilot: delivering greater context to pre-analyses
The Use Case database is also leveraged by Reveelium's LLM Copilot. Operating via a RAG (Retrieval-Augmented Generation) approach, it queries relevant elements from its knowledge base upon receiving a new alert, integrating them into its context to generate its pre-analysis.
Use Cases provide access to a targeted, highly qualified corpus: real-world cases originating from the client's environment, fully analyzed and contextualized.
The objective is to enhance the accuracy and relevance of pre-analyses by leveraging the knowledge accumulated across investigations. Rather than solely prioritizing raw data volume, the Copilot can draw upon cases selected specifically for their value. In other words: one hundred well-documented cases are worth far more than one hundred thousand raw events.
Concrete use case: when the SOC encounters a known situation
Consider the example of a threat flagged in Reveelium.
- The SOC analyst initiates their investigation. Following analysis and discussions with the client, the root cause is identified: the observed behavior corresponds to a monthly batch process run by a third-party vendor. The threat is ultimately closed as a false positive.
- A few weeks later, a similar scenario reoccurs. Without effective capitalization, a second analyst might have to restart the investigation from scratch and reach out to the client again for information that has already been supplied. With Use Cases, the initial analysis has become a benchmark. The technical scenario, the analyst's conclusion, and the operational context provided by the client are readily available in the knowledge base.
- When the new alert triggers, this knowledge can be retrieved by the analyst and integrated into the context utilized by the Copilot for its pre-analysis.
It is not about automatically assuming that two similar situations necessarily share the same explanation. It is about retaining what has already been learned and providing the analyst with the necessary elements to decide more quickly what warrants a new investigation.
A knowledge base that grows richer with every analysis
The value of this feature builds over time.
Every threat converted into a Use Case enriches the knowledge available regarding the client's environment. Each analysis conducted today can then serve as a benchmark for tomorrow's. For analysts, it provides a qualified history to rely on. For the LLM Copilot, it serves as a context source drawn from real-world cases. And for the client, it is a way to capitalize on the knowledge built throughout interactions with the SOC.
“It is an asset that builds up, and one that belongs to you. The most effective knowledge base is the one that combines both perspectives: the SOC engineer's technical analysis and the client's business context.”
Mathieu, Head of R&D at ITrust
