SECURITY THREAT INVESTIGATION

1 . A computer-implemented method for security threat investigation, comprising:

receiving an analysis request based on a suspicious activity alert;

extracting, responsive to receiving the analysis request and based on the suspicious activity alert, key details from process data associated with the suspicious activity alert;

identifying telemetry data during a predefined period prior to and after the suspicious activity alert;

retrieving contextual data and organizational data associated with the process data;

generating a prompt based on at least the telemetry data, the contextual data, and the organizational data; and

receiving an analysis report, wherein the analysis report identifies, based on the prompt, potential threats and remediation steps.

2 . The computer-implemented method of claim 1 , wherein generating the prompt is based on derived context and guidance of at least the telemetry data, the contextual data, and the organizational data.

3 . The computer-implemented method of claim 1 , wherein the key details comprise one of process IDs, code signing information, users, and command line arguments for each process associated with the suspicious activity alert.

4 . The computer-implemented method of claim 1 , wherein identifying the telemetry data comprises focusing on relevant factors comprising one of related processes, users, and network activity.

5 . The computer-implemented method of claim 1 , further comprising searching a threat feed service to retrieve related information associated with the process data.

6 . The computer-implemented method of claim 5 , wherein the related information comprises one of security research and malware tactics, techniques, and procedures.

7 . The computer-implemented method of claim 1 , wherein the prompt comprises a system message and a user message, wherein the system message is static and the user message is dynamically generated based on a detected event that triggers the suspicious activity alert.

8 . A system comprising:

a memory comprising instructions; and

a processor configured to execute the instructions which, when executed, cause the processor to:

receive an analysis request based on a suspicious activity alert;

extract, responsive to receiving the analysis request and based on the suspicious activity alert, key details from process data associated with the suspicious activity alert;

identify telemetry data during a predefined period prior to and after the suspicious activity alert;

retrieve contextual data and organizational data associated with the process data;

generate a prompt based on at least the telemetry data, the contextual data, and the organizational data; and

receive an analysis report, wherein the analysis report identifies, based on the prompt, potential threats and remediation steps.

9 . The system of claim 8 , wherein the prompt is based on derived context and guidance of at least the telemetry data, the contextual data, and the organizational data.

10 . The system of claim 8 , wherein the key details comprise one of process IDs, code signing information, users, and command line arguments for each process associated with the suspicious activity alert.

11 . The system of claim 8 , wherein identifying the telemetry data comprises focusing on relevant factors comprising one of related processes, users, and network activity.

12 . The system of claim 8 , wherein the processor is further configured to execute the instructions which, when executed, cause the processor to search a threat feed service to retrieve related information associated with the process data.

13 . The system of claim 12 , wherein the related information comprises one of security research and malware tactics, techniques, and procedures.

14 . The system of claim 8 , wherein the prompt comprises a system message and a user message, wherein the system message is static and the user message is dynamically generated based on a detected event that triggers the suspicious activity alert.

15 . A non-transitory machine-readable storage medium comprising machine-readable instructions for causing a processor to execute a method, the method comprising:

receiving an analysis request based on a suspicious activity alert;

extracting, responsive to receiving the analysis request and based on the suspicious activity alert, key details from process data associated with the suspicious activity alert;

identifying telemetry data during a predefined period prior to and after the suspicious activity alert;

retrieving contextual data and organizational data associated with the process data;

generating a prompt based on at least the telemetry data, the contextual data, and the organizational data; and

receiving an analysis report, wherein the analysis report identifies, based on the prompt, potential threats and remediation steps.

16 . The non-transitory machine-readable storage medium of claim 15 , wherein generating the prompt is based on derived context and guidance of at least the telemetry data, the contextual data, and the organizational data.

17 . The non-transitory machine-readable storage medium of claim 15 , wherein the key details comprise one of process IDs, code signing information, users, and command line arguments for each process associated with the suspicious activity alert.

18 . The non-transitory machine-readable storage medium of claim 15 , wherein identifying the telemetry data comprises focusing on relevant factors comprising one of related processes, users, and network activity.

19 . The non-transitory machine-readable storage medium of claim 15 , further comprising searching a threat feed service to retrieve related information associated with the process data.

20 . The non-transitory machine-readable storage medium of claim 15 , wherein the prompt comprises a system message and a user message, wherein the system message is static and the user message is dynamically generated based on a detected event that triggers the suspicious activity alert.