Topic starter
06/11/2026 6:37 pm
TL;DR: Nine markdown-based skills for its CLI can turn repetitive SOC, CTI, vulnerability and brand-protection work into structured investigations, according to Censys research, with the assistant loading only the relevant skill and confirming expected API cost before it starts. The governance issue is not speed alone but whether investigations preserve bookkeeping, evidence and scope when analysts are tired or understaffed.
Editorial analysis by NHI Mgmt Group, based on content published by Censys: “Introducing Censys CLI Skills: AI-Assisted Investigations at Scale”.
Key questions
Q: How should SOC teams preserve investigation evidence for later review?
A: SOC teams should preserve evidence by capturing the original alert, related logs, timestamps, query parameters, hashes, packet captures, and any analyst actions in a case record with chain-of-custody controls.
Q: Why do analysts miss patterns when investigations are done one query at a time?
A: Analysts miss patterns when they run isolated queries because each result is only a snapshot and the relationships between hosts, users, processes, and timestamps are not retained.
Q: How does infrastructure pivoting work in threat hunting?
A: Infrastructure pivoting is the process of moving from one observed asset, such as a host, IP address, account, or process, to related infrastructure to expand a threat hunt.
Practitioner guidance
- Define a mandatory investigation record Capture the initial alert, each pivot, every null result, and the final rationale in a format another analyst can review without re-running the whole case.
- Set preflight limits for deeper hunts Require the assistant to confirm the target and expected API call count before it branches into broader enrichment or related-infrastructure searches.
- Use object pivots to build watchlists Move from a single IP or domain to certificates, host keys, body hashes, and related names so the next sighting is detectable before the ticket arrives.
Bottom line: Security teams lose value when investigations end with a verdict but no evidence trail, because later review depends on the steps that were preserved.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Structured investigation is now a governance control, not a convenience feature. The central lesson here is that analyst judgment fails when it is forced to operate one query at a time without a retained trail. A model that captures the population count, the empty pivot, and the raw evidence turns an investigation into something auditable. That matters across SOC and CTI because the quality of an answer depends on the quality of the method that produced it.
A question worth separating out:
Q: What should teams do first when an alert looks suspicious but incomplete?
A: The first step is to preserve the alert and surrounding context, then validate the signal by checking related telemetry before taking disruptive action. That usually means collecting logs, process data, identities, and recent changes, then classifying the event as benign, suspicious, or likely malicious so the response matches the evidence.
👉 Read our full editorial: AI investigation skills turn repetitive SOC triage into structured analysis