Case Copilot Agent
Half the IR pain is 'what's the latest?' — solved.
Watches every linked finding, rewrites the case context as evidence lands.
When alerts escalate into a case, Case Copilot reads everything linked to it — alerts, IOCs, comments, agent verdicts, state transitions — and rewrites the case summary and recommended next steps on demand. The on-call analyst opens the case at 2am, hits refresh, and reads the latest version, not yesterday's stale one.
CASE-019 · OAuth abuse · DC-VPN-099
Timeline
Linked: ALERT-9842 — Suspicious OAuth from DC-VPN-099
State: open → triaged
IOC linked: 185.101.94.215 (APT28 C2)
Investigation agent finished · severity=Critical · conf=0.91
Analyst: 'CASE-018 covered the same TTP, reopen instead of dup.'
State: triaged → in_progress
Auto-summary
OAuth abuse on DC-VPN-099 from a known C2 attributable to APT28. Investigation agent confirmed the link with conf=0.91 across 4 iterations. CASE-018 covered the same TTP last quarter and the analyst flagged this as a re-open candidate, not a duplicate.