Layer 4: Investigation, Case Management & Automated Response

1. Overview & Architectural Role

Layer 4 represents the decisive resolution plane of the TIDIR architecture. While Layer 1 emits telemetry, Layer 2 transports and stores data, and Layer 3 synthesizes detections and risk-scored incident dossiers, Layer 4 executes the critical operational workflows: investigating root causes, validating attack scope, containing adversary momentum, and restoring trusted operations.

Rather than treating case management as a static ticketing queue and automation as brittle, unconstrained scripts, Layer 4 establishes a symbiotic operating model between agentic harnesses and human operators, governed by an immutable Blast-Radius Risk Tiering framework.

---

2. Investigation & Case Management Architecture

Effective incident investigation requires rapid contextualization across disparate event streams without manual pivot fatigue. Layer 4 provides three core investigative primitives:

1. Entity Graph Resolution & Traversal

• Graph Data Structure: Incoming findings are projected into an interconnected graph model where nodes represent resolved entities (Actor, User, Credential, Process, Host, IP, Domain, Cloud Resource) and edges represent verified actions (AUTHENTICATED_TO, SPAWNED, CONNECTED_OUTBOUND, ASSUMED_ROLE, ENCRYPTED_FILE).
• Parent-Child Process Reconstruction: Endpoint execution paths are mapped back to root processes, distinguishing benign system utilities from anomalous command interpreters (e.g. tracking an unexpected shell spawn from an unmanaged web service worker).
• Identity Traversal: Reconstructs complete multi-cloud identity journeys, tracking an external VPN authentication to a session token issue, role assumption, and administrative policy edit.

2. Unified Chronological Timeline Reconstruction

• Multi-Source Interleaving: Reassembles events across multiple layers—correlating Layer 1 perimeter logs, Layer 2 lakehouse historical queries, and Layer 3 alert triggers into a single continuous temporal stream.
• Clock-Skew Normalization: Re-indexes events using coordinated time horizons to eliminate discrepancies across distributed cloud provider regions and on-premises physical clocks.
• Milestone Extraction: Automatically tags key attacker actions (Initial Access, Defense Evasion, Persistence, Exfiltration) directly onto the timeline to accelerate cognitive intake for responding analysts.

3. Tamper-Evident Evidence Locker

• Cryptographic Hashing: All forensic artifacts (packet captures, memory triage excerpts, disk image snapshots, script payloads) collected during an investigation are sealed with SHA-256 content hashes.
• Immutable Chain-of-Custody: Every access, analysis, or export operation is immutably logged to an append-only audit register, ensuring admissible legal integrity for regulatory reporting and post-incident disclosures.

---

3. Symbiotic Operator Model: Agentic & Human Collaboration

Modern high-velocity security operations cannot rely exclusively on human triage (which cannot scale to enterprise alert volumes) nor unconstrained autonomous agents (which lack business context and risk tolerance). Layer 4 pairs Agentic AI Harnesses with Human SecOps Operators in a continuous collaborative loop:

1. The Agentic Investigation Harness (The Analytical Multiplier)

• Autonomous Scoping Queries: The agent immediately dispatches federated queries to the Layer 2 lakehouse without human prompting—determining whether a suspicious IP has appeared elsewhere in the last 90 days, checking authentication baselines, and enumerating sibling assets.
• Hypothesis Formulation: Evaluates the evidence against established attack patterns and outputs a plain-language hypothesis detailing: What happened, how access was gained, what assets are affected, and what the attacker is attempting next.
• Action Plan Drafting: Proposes an exact sequence of remediation steps, complete with estimated downtime, user impact, and blast-radius scores.

2. The Human Operator Workbench (The Judgment Anchor)

• Cognitive Primacy: The human operator is never forced to start from scratch. They review a pre-triaged case dossier with full evidence citations.
• Exploratory Steering: Analysts can command the agentic harness using natural language or structured queries ("Check if any other host received this PowerShell payload in the last 48 hours").
• Exclusive Authority Over Disruptive Actions: Human operators retain sole execution authority for any action classified as potentially disruptive to business operations.

---

4. Blast-Radius Gated Response & Automation (SOAR)

To eliminate operational risk while maximizing response velocity, automated actions are strictly compartmentalized into three Blast-Radius Risk Tiers:

Blast-Radius Risk Tier Matrix

Risk Tier	Authorization Policy	Permitted Actions	Automated Rollback Requirement
Tier 0: Passive Enrichment	Fully Autonomous	Read-only threat intel queries, directory lookups, telemetry scoping, lakehouse scans.	Not applicable (no environmental state mutation).
Tier 1: Targeted Containment	Autonomous for High-Confidence / Low-Criticality Assets	Host-level process termination, untrusted file quarantine, temporary IP rate-limiting, user session lock.	Mandatory 1-click rollback script verified in advance.
Tier 2: Disruptive Containment	Mandatory Dual-Operator or Senior SecOps Approval	Production database network isolation, global firewall rules, tenant-wide account locks, certificate revocation.	Step-by-step verified compensation and recovery procedure.

Pre-Execution Blast-Radius Impact Simulator (Anti-Rubber-Stamping Gate)

In high-stress security incidents, human operators suffer cognitive exhaustion. If an agentic harness presents a compelling narrative recommending host isolation or credential revocation, analysts risk default "rubber-stamping" without verifying topological ramifications.

To prevent inadvertent business disruption from false-positive agent recommendations, Layer 4 mandates a Deterministic Pre-Execution Impact Simulator:

• Live Dependency Evaluation: Before presenting an authorization modal to the human operator, the SOAR engine queries Layer 1 CMDB relationships and Layer 2 network flow records to compute active blast radius metrics:
  • Active Connection Count: (e.g. 1,420 client TCP sessions currently routed to this workload).
  • Downstream Service Dependencies: (e.g. Host app-worker-04 is a member of the primary payment processing pool).
  • Data Volume in Flight: (e.g. Active database read-replica synchronization in progress).
• Explicit Impact Card Rendering: Authorization interfaces present the simulation summary alongside the agentic recommendation:

  ⚠️ Pre-Execution Blast-Radius Preview: Authorizing isolation on srv-payment-api-01 will immediately sever 42 active microservice communication channels and degrade Checkout Gateway Availability. Estimated operational recovery time: 12 minutes.

• Mandatory Reversible Rollback Scripts: No Tier 2 containment action can be initiated unless an automated compensation/rollback routine (e.g. reversing network isolation, unblocking firewall IP, restoring suspended token) has been cryptographically validated and loaded into memory.

---

5. Closed-Loop Architectural Feedback

A healthy security architecture is an adaptive, learning feedback loop. Every incident investigated and closed in Layer 4 generates continuous improvements across the entire platform:

1. Feedback to Layer 3 Cyber Threat Intelligence (CTI): Confirmed attack indicators, C2 infrastructure, and campaign identifiers uncovered during forensics are automatically packaged into STIX 2.1 entities, enriching the internal CTI repository and initiating automated retro-hunts across Layer 2.
2. Feedback to Layer 3 Detection Engineering (DaC): Benign activities that triggered false alarms produce automated exclusion pull requests in the Detection-as-Code repository, while true attacks generate new synthetic regression test cases to prevent future detection drift.
3. Feedback to Layer 1 Data Sources: If an investigation identifies forensic blindspots (e.g., missing command-line arguments, unlogged cloud API actions, unmonitored DNS requests), Layer 4 logs a Telemetry Visibility Gap to prompt configuration updates in Layer 1 collection agents.