CloudPeek

Use case · Investigation - Investigations

CloudPeek gathers the evidence behind an incident and explains what happened, what was affected and what to do next. Your team gets a clear report to review and act on.

← All use cases
Use case
Investigations
What you get
A clear incident report
Who decides
Your team sets the authority.
Full CloudPeek investigation answering a request to summarise the last 24 hours of incidents
Ask a question in plain language and review the tools the agent ran to answer it.

The challenge

An alert passed for investigation is only the beginning. Someone still has to search across tools, connect events and write an account that responders, managers and reviewers can all understand.

How CloudPeek helps

Investigations: an illustrative CloudPeek workflow
See how CloudPeek works · 30 secondsIllustrative scenario

  1. Collects relevant information from your connected tools and builds a timeline, keeping the sources attached to the investigation.

  2. Follows the evidence to examine which people or systems were involved, how far the issue spread and what caused it.

  3. Produces a structured report with the findings, supporting evidence and recommended next steps, ready for an analyst to review and amend.

What your team gets

A clear incident report

Give decision makers a coherent explanation of the incident, with evidence they can follow back to its source.

Clear next steps

Responders receive the findings and recommendations together, helping them decide what action is appropriate for the affected systems.

A shared investigation record

Keep the investigation and its findings in a shared record that the next analyst can inspect and build on.

You stay in control

Investigation begins with reviewing information. Your analyst can guide the work and approve recommendations; any enabled response follows your chosen approval rules and the boundaries you have set.

Talk to us
Explore the technical example
Runs on
SIEM · EDR · identity · cloud · ITSM
Autonomy
levels 1 to 3
CloudPeek // flow · escalation to write upflow 02 · INC-2418
  • EDR telemetry
  • sign in history
  • cloud audit
  • prior incidents
  • new lead · another pass
  1. OPENescalated from triage
  2. TIMELINE412 events · 38 kept
  3. CORRELATE4 sources · 3 passes
  4. ROOT CAUSEconsent grant · 11 Aug
  5. WRITE UPevidence linked
  6. HANDOVERentity pages updated
iterative by design · pivots on what it finds · the operator can steer at any pointEvery step recorded
CloudPeek // action trail · illustrative entriesautonomy level 2
  1. 09:27:01OPENEscalation from triage. Suspected credential abuse, 1 identity, 2 hosts.
  2. 09:27:04TIMELINEEvents aligned across SIEM, EDR, identity and cloud audit. 412 events, 38 relevant.
  3. 09:27:39SCOPEBlast radius established: 2 hosts, 1 service account, 1 shared mailbox. No lateral movement found.
  4. 09:28:02ROOT CAUSEToken issued to an unmanaged device following a consent grant on 11 August.
  5. 09:28:15WRITE UPNarrative, timeline, scope, root cause and recommended actions produced with evidence linked.
  6. 09:28:16HANDOVEREntity pages updated. Findings available to the next investigation touching these assets.
read only by default · policy bounded · kill switch with the operatorAll actions traced
At level 1The full investigation and write up are prepared. Your analyst reviews, amends and signs it off.
At level 2Recommended actions arising from the investigation are staged and held for approval.
At level 3Investigation and the actions it recommends run inside declared guardrails, fully recorded.

Certifications & recognition

  • Tech Nation Rising Stars — Regional winner
  • Cyber Essentials Certified
  • Tech4Trust, powered by Trust Valley