AI investigation skills turn repetitive SOC triage into structured analysis

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Censys's blog post: Nine markdown-based skills for cencli aim to make repeated investigations more structured, cheaper to run, and less dependent on perfect memory at queue speed.

Why it matters: This matters because security teams need investigation workflows that preserve traceability, not just automation that makes the next query faster.

Context

SOC investigations often fail at the handoff between an initial alert and a defensible conclusion. When analysts are under time pressure, they skip counts, lose intermediate pivots, and close tickets on incomplete evidence, which makes later review difficult and weakens detection engineering feedback loops. Treat SOC staffing and shift models as part of the control environment here, because tired analysts and deep queues shape the quality of every downstream judgment.

In this case, the core governance problem is not whether an analyst can query faster, but whether the investigation process remains reproducible when a person is unavailable, distracted, or working from a partial picture. The same issue appears across SOC, CTI, vulnerability management, and brand protection because each relies on durable evidence, not just a final verdict.

Censys frames its new skills as a way to encode investigative discipline into an AI assistant so that bookkeeping, branching logic, and evidence capture happen more consistently. That is a typical response to analyst fatigue and queue pressure, not an unusual one.

Key questions

Q: How should SOC teams preserve investigation evidence for later review?

A: SOC teams should preserve evidence by capturing the original alert, related logs, timestamps, query parameters, hashes, packet captures, and any analyst actions in a case record with chain-of-custody controls. Store the artefacts in immutable or access-controlled evidence storage, keep time synchronisation consistent, and record enough context for another analyst to reproduce the investigation later.

Q: Why do analysts miss patterns when investigations are done one query at a time?

A: Analysts miss patterns when they run isolated queries because each result is only a snapshot and the relationships between hosts, users, processes, and timestamps are not retained. One query at a time also loses investigative context, so pivots, joins, timeline correlation, and entity-level grouping are needed to surface multi-step attack chains.

Q: How does infrastructure pivoting work in threat hunting?

A: Infrastructure pivoting is the process of moving from one observed asset, such as a host, IP address, account, or process, to related infrastructure to expand a threat hunt. Analysts follow links in logs, DNS, certificates, routes, and service relationships to map adjacent systems and uncover hidden attacker infrastructure or lateral movement.

Q: What should teams do first when an alert looks suspicious but incomplete?

A: The first step is to preserve the alert and surrounding context, then validate the signal by checking related telemetry before taking disruptive action. That usually means collecting logs, process data, identities, and recent changes, then classifying the event as benign, suspicious, or likely malicious so the response matches the evidence.

Technical breakdown

Why AI-assisted investigations need a fixed bookkeeping layer

A usable investigation workflow is not just a sequence of queries. It also needs a record of what was asked, what came back, what was excluded, and why the conclusion changed. In high-volume SOC work, analysts often jump from a suspicious IP or domain to a verdict without preserving the intermediate steps that would let another person reproduce the result. That is why structured prompts, query counts, and explicit negative findings matter. They turn an ad hoc search into a repeatable method that can survive shift changes, escalations, and post-incident review. See the AI SOC Guide.

Practical implication: Define required evidence fields for every investigation so analysts and agents cannot close a case without a traceable chain of reasoning.

How Censys object models support pivoting across infrastructure

The platform’s model separates hosts, web properties, certificates and names into distinct objects, which makes one observable useful for finding others. That matters because infrastructure rarely appears in one form only. A certificate can reveal multiple names, a host can expose services and TLS material, and DNS history can show how a target changed over time. The technical value is in treating each object as a pivot point rather than a final answer. That enables analysts to move from a single indicator to a broader population, or from one machine to the related build and hosting pattern behind it.

Practical implication: Use object-level pivots to move from one indicator to a durable infrastructure pattern instead of stopping at the first hit.

Why skill gating matters in agentic SOC workflows

Agentic workflows become expensive when the assistant over-investigates every prompt. The control problem is to stop the assistant from launching deep searches when a single lookup is enough, while still allowing deeper branching when the first result suggests a real pattern. Censys describes this as trigger-based loading with a lighter pass before a heavier investigation. That is a sensible architecture because it reduces unnecessary API use, avoids noisy overreach, and keeps the human operator in charge of when a simple question becomes a hunt. The important point is that the model is procedural, not autonomous. Read AI Agents vs Agentic AI.

Practical implication: Gate deeper investigation paths behind explicit triggers and preflight cost checks so an assistant cannot burn time or API calls without justification.

Threat narrative

Attacker objective: The objective is to keep suspicious infrastructure from being linked to the broader activity pattern before defenders can escalate the case.

1. Entry begins with a suspicious outbound connection from a workstation to a VPS, which is exactly the kind of event that can be dismissed when the analyst only inspects the first observable.
2. Credential access is not the only issue here. The real failure is investigative access to context, because the analyst does not preserve enough evidence to decide whether the destination is benign or part of a larger pattern.
3. Impact occurs when the ticket closes with no reproducible trail, leaving the team unable to correlate the event with related infrastructure, detections, or later incidents.

Breaches seen in the wild

• Malwarebytes breach 2021: SolarWinds attackers added a certificate to a dormant email security app's service principal at Malwarebytes and read internal email via Microsoft Graph.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Structured investigation is now a governance control, not a convenience feature. The central lesson here is that analyst judgment fails when it is forced to operate one query at a time without a retained trail. A model that captures the population count, the empty pivot, and the raw evidence turns an investigation into something auditable. That matters across SOC and CTI because the quality of an answer depends on the quality of the method that produced it.

Bookkeeping is the named failure mode this model is designed to fix. The article’s strongest idea is that missing notes, not missing data, are what make investigations brittle. That is a control gap in itself, especially when shift workers inherit tickets from one another. Preserving the path to the answer is what lets another analyst challenge or confirm the conclusion later, which is the real standard for defensible detection work.

Agentic tooling should be judged on whether it preserves analyst intent. A query assistant that can pivot is useful only if it also records why a pivot happened and what was ruled out. Without that discipline, AI simply speeds up a weak process. The field should therefore evaluate these tools as investigation infrastructure, not as novelty automation, and require evidence retention by design.

The most valuable AI skill in security is controlled repetition. Repeated tasks are where humans become inconsistent, while assistants become predictable. That does not make the assistant autonomous. It makes it useful in places where routine work must still be explainable, especially in queue-driven environments where the analyst does not have time to reconstruct every false start. The practitioner conclusion is to automate the sequence, not the accountability.

What this signals

Bookkeeping will become a core SOC quality metric. As agents absorb more repetitive triage work, teams will need to measure whether those workflows preserve provenance, negative findings, and reviewability. The operational question is no longer whether automation can answer faster, but whether it leaves enough evidence for a second analyst to trust the answer.

Structured investigation will outlast raw query volume. Teams that treat AI as an assistant to process, not as a substitute for judgment, will get better outcomes because they can force the tool to log what it asked, what it ruled out, and why it escalated. That is the difference between automation that accelerates noise and automation that improves decision quality.

For practitioners

• Define a mandatory investigation record Capture the initial alert, each pivot, every null result, and the final rationale in a format another analyst can review without re-running the whole case.
• Set preflight limits for deeper hunts Require the assistant to confirm the target and expected API call count before it branches into broader enrichment or related-infrastructure searches.
• Use object pivots to build watchlists Move from a single IP or domain to certificates, host keys, body hashes, and related names so the next sighting is detectable before the ticket arrives.
• Separate quick lookups from full investigations Create two paths for analyst use, one for a direct answer and one for a deeper hunt, so routine questions do not trigger expensive branching by default.

Key takeaways

• Security teams lose value when investigations end with a verdict but no evidence trail, because later review depends on the steps that were preserved.
• The article’s central operational insight is that AI is most useful when it automates repetitive investigation bookkeeping, not when it replaces analyst judgment.
• Practitioners should treat query counts, negative findings, and pivot history as required artefacts for SOC and threat-hunting workflows.

Related NHI Mgmt Group resources: AI SOC Guide · AI SOC Platform Buyer's Guide · AI Agents vs Agentic AI

Key terms

• Investigation Bookkeeping: Investigation bookkeeping is the structured recording of what an analyst checked, what evidence was collected, and what conclusions were reached during a security investigation. It usually includes case notes, timestamps, query logic, artefact references, and decision points so the work can be reviewed, reproduced, and handed over cleanly.
• Infrastructure Pivoting: The process of moving from one known malicious indicator to related ones, such as domains, IP addresses, subdomains, hashes, or DNS history. Analysts use pivots to expand visibility across a campaign and identify related samples or hosts, especially when attackers rotate infrastructure to reduce detection and attribution confidence.
• Host Key: A host key is a cryptographic key that identifies a specific server or device to clients during secure connections. Attackers target host keys to impersonate systems or intercept sessions, so administrators must protect private host keys, monitor for unexpected changes, and replace any key that is exposed or unknown.
• Self-signed certificate: A self-signed certificate is a certificate signed by the same entity that issued it, rather than by a trusted certificate authority. It can enable encrypted connections in limited cases, but it is not inherently trusted, so attackers may abuse it for spoofing unless clients explicitly pin or verify it.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security workflows their programmes depend on.