The Dropzone AI solution is engineered with a specific focus on: 

• Explainability so that humans can easily verify decisions and the criteria on which they were made

• Data lineage to provide an audit trail, giving users confidence in Dropzone AI’s evidence-based analysis

• Guardrails to protect against hallucinations

• Continuous internal sandbox/lab testing and validation

Obtain information
Dropzone AI connects to your security tools and receives alerts. Customers can filter which alerts the Dropzone AI solution investigates.

Strategize and plan
Dropzone AI is pre-trained to handle a wide-variety of alert investigations, such as phishing reports and detections from EDR, firewall, identity, SaaS, and cloud service providers. For each alert, Dropzone AI will formulate multiple hypotheses of why the alert fired and the lines of investigation that need to be pursued.Importantly, the Dropzone AI solution recursively reasons like a human. So after collecting and analyzing evidence, it will keep formulating additional hypotheses and lines of investigation until it reaches a final conclusion.

Collect evidence
To pursue lines of investigation, the Dropzone AI solution collects evidence from the customer’s security tools and internal systems just as a human analyst would. Expert modules are pre-trained to replicate an analyst skill, such as composing Splunk queries. Dropzone AI also uses threat intelligence, reputation services, and other tools such as VirusTotal and the WHOIS database to enrich IOCs such as IP addresses and file hashes.

Analyze
Dropzone AI replicates Tier 1 SOC analyst skills needed for analysis of data. For example, the expert modules can use Wireshark to parse network packet captures for Log4J exploit markers, identify obfuscation techniques in Powershell scripts, analyze phishing attachments, and reconstruct malware process trees from commands and files. An important feature of Dropzone AI is organizational context memory, which builds up the same type of institutional knowledge (understanding of your environment and business) that a human would. The Dropzone AI solution reads directory services, Jira tickets, and emails and perfectly recalls details when needed, such as why a SharePoint folder is OK to share with certain email addresses outside of the organization. Customers can add to this context memory inside of the Dropzone AI product by teaching the solution using a natural language interface.

Report
Once the Dropzone AI solution has completed all the investigation steps, it composes a summary report that includes a recommended conclusion on whether the alert is benign, suspicious, or malicious. The conclusion is built from the findings that are explained along with data sources used, and human analysts reviewing the report have links to raw evidence (logs, etc.).

Respond
Dropzone AI helps with response in three ways:Help human investigators quickly get answers for follow-on questions through a natural-language chatbot interface.Offer recommended remediation actions. Automate containment actions, such as quarantining an infected endpoint, disabling compromised user credentials, and blocking a malicious IP address. These automated actions are completely configurable.

The following diagram and table explains how Dropzone AI performs autonomous alert triage and investigation.

Dropzone AI investigation quality improves as the AI SOC analyst learns about the company and environment Importantly, this context memory is built and exists solely within the customer’s tenant and cannot be mixed with other customers’ deployments. 

Customers will commonly add facts to context memory such as:

• Company owned IP ranges

• Allowed VPN services and policies

• Individuals that conduct security testing

• Hosts with special functions, such as Jenkins automation, critical application servers, data stores with sensitive information, and legacy infrastructure with known vulnerabilities that cannot be patched

• Internal tool names and their purposes

• Cloud IAM roles used for automation and administration

• Office locations

As a result of investigations, Dropzone AI will infer details such as which AWS roles have which permissions.

Security domain experts employed by Dropzone AI manually review investigations to look for areas where we can improve the knowledge and tools available to the AI analyst. Read about our QA program.

Dropzone AI uses multiple independent agents (expert modules) that limit the scope of what is being asked of each individual agent and avoid hallucinations. 

• Expert knowledge - Each expert module combines LLM reasoning capability with expertise, derived from authoritative sources such as product documentation. 

• Up-to-date information - Expert modules have access to up-to-date information by accessing internal systems, security tools, threat intelligence, and public tools such as the WHOIS and NVD databases. 

• ‍Specificity - When an alert is received, Dropzone AI will strategize and plan the investigation, assigning specific tasks to expert modules pre-trained to complete that type of task.