Review Findings

The Findings Summary is an overview of the observed signals, context, and analysis conducted by the Nebulock agents that provides you with an assessment of the activity. While the Finding remains open and under investigation, this summary will be updated as new signals are discovered on the host. Just below the Summary is a description indicating the Likelihood the observed activity is malicious, based on the data in the Summary.

Signals are the catalysts that begin an agentic analysis process. These signals come from Nebulock written rules, or rules you have written in your portal. A Finding can have one or more signals, and these signals are displayed with related context. E.g. - EDR data will include parent processes, command lines, and file paths.

To see this contextual data, click on a specific Signal to view details around connected events. This will also provide a query to run in your EDR to find these events.

For a chronological view of the Signals, expand the Signal Timeline. This will show each signal on a graph, with tick marks indicating when the signal was triggered. This view provides visual understanding of signal data, including number of times it triggered and its cadence.

The Agent Thought Process is a transparent view into how Nebulock agents problem solve. The thought process provides a step-by-step look into actions taken by the agents as they reason across the Finding signals and context and come to a determination. This information allows for transparency and trust in the Nebulock platform.

Status and Resolution

Findings Status is used to determine the current state of the finding as it moves through a workflow. OPEN → IN PROGRESS → CLOSED

Findings Resolution is used to identify the outcome of the Finding.

• True Positive - Confirmed malicious activity or policy violation
• False Positive - Alert fired incorrectly, no actual threat
• Benign Positive - Real activity detected but authorized/expected

It is important to close out a Finding with the proper status and resolution when you have finished your review. The Nebulock agent uses these resolutions to arbitrage new signals, looking across similar Findings to determine how to proceed. Your input via the resolution ensure the agent has accurate, up to date context needed for successful arbitration.