Reconstruct agentic-AI intrusion sequences from endpoint, identity, cloud and network evidence while keeping containment and case closure under human control.
Why agentic attack-chain reconstruction matters now
CrowdStrike published research on October 21 describing four previously unreported threat actors that used AI agents to make operational decisions and execute commands. Its researchers say the incidents occurred from May through August and involved several orchestration patterns, from predefined state machines to more flexible multi-agent workflows.
Independent coverage on October 27 and 28, including Ground News and Aviatrix's weekly security recap, kept the report in current discussion. A focused Firecrawl search on October 29 returned the CrowdStrike report with those independent reports among the prominent results. That is a public-attention signal, not proof of prevalence, traffic, ranking or a local detection rate.
The defensive problem is practical: machine-speed activity can produce many related events before an analyst has a stable timeline. AI can help normalize and connect those records, but the source telemetry—not the model narrative—must remain authoritative.
1. Freeze the evidence window before asking for a story
Start with a bounded incident window and immutable copies of endpoint process events, identity sign-ins, cloud control-plane records, DNS, proxy and network telemetry. Record collection gaps, clock sources, retention limits and the query used for each export. Hash or version the evidence bundle where your process supports it.
Do not begin by asking a model to explain the attack. First normalize timestamps, principal identifiers, hosts, workloads, sessions and tool invocations. Keep original fields beside normalized values so every transformed event can be traced back to its source.
Use redacted, approved evidence and a read-only analysis identity. Exclude credentials, unrelated personal data and production action tokens. Record the model, prompt, connected tools and retention choice used for the review.
- Define one incident window and named evidence owner.
- Preserve source IDs, timestamps and collection queries.
- Treat missing telemetry as a finding, not an invitation to guess.
2. Build an event graph with competing hypotheses
Ask for a table or graph in which every node contains the observed time, source record, actor or process, action, target and confidence. Require separate labels for observed, inferred and unknown. A model may connect two events because they are adjacent in time; that does not prove they share an operator or objective.
Example prompt: 'Using only the supplied evidence bundle, create a chronological event graph for case IR-104. Cite the source record for every node. Separate observed facts, normalization choices, inferences and unknowns. Propose at least two plausible explanations for each disputed transition. Do not recommend or execute production actions.'
Agentic behavior is one hypothesis, not a magic detector label. Look for repeatable evidence of delegated decisions, tool chaining, parallel tasking or rapid action selection, while also testing simpler explanations such as scheduled automation, an administrator script or a compromised service account.
3. Convert the graph into a human-reviewed response plan
For each high-confidence branch, ask for the affected identities and systems, supporting and contradicting evidence, the reversible containment options and the evidence that would justify each option. Prefer narrow actions such as revoking one session, isolating one workload or blocking one indicator over an unbounded response.
Run the output through the normal incident commander, system owner and legal or privacy gates. The assistant should never possess the credentials used to disable accounts, isolate hosts, change firewall policy or delete cloud resources.
CrowdStrike's report is a vendor analysis of observed campaigns. DeepSecurity.io did not reproduce those incidents or benchmark an AI investigator. The expected output here is a more reviewable incident packet, not faster containment or improved detection unless your own pilot measures it.
4. Test the method on known fixtures and close the case defensibly
Pilot on historical cases or synthetic timelines with known answers. Include clock skew, duplicate events, an innocent automation sequence, an incomplete sensor and a branch with contradictory identity evidence. Score citation completeness, false connections, missed events, reviewer corrections and time spent—not the polish of the prose.
Set stop conditions: uncited claims, invented events, suppression of contrary evidence, action outside scope or a failure to distinguish observation from inference. Preserve the failed output with the fixture so reviewers can decide whether to adjust the workflow or end the pilot.
The closeout should contain the evidence inventory, event graph, unresolved gaps, selected hypothesis, rejected alternatives, approved actions, validation results and residual risk. That record remains useful even when the final conclusion is that the activity was ordinary automation.
Put the insight into practice.
Deep Security helps organizations assess risk, validate controls, and build a practical plan to strengthen their defenses.
Talk with Deep Security