Skip to content
LEGIT AIDOCS
Open the console

Detection loop

How events are read into findings and the entity graph, and how the decisions people make are written back.

Detection loopEvents are read in, decisions are written back
AnalystAI analystApproverAI analystAdministratorConsole, phone and APIFindings and entity graphEventlegit.event.v1Received atRaw recordTagsAlertEvidenceRule matchesMITRE ATT&CKStatusAssetHostnameAddressesCriticalityAgentRuleConditionsTest eventsFalse positivesHit rateInvestigationAlertsEvidenceTimelineNotesIndicatorValueSourceConfidenceWhere seenraisesonmatched bygrouped inseen onReadWindows agentSSH collectorSyslog and the APILog files and capturesRouters and cloudWrite backConfirmStatus and timelineDismiss with a reasonCounts against the ruleEscalateOpens an investigationRequest a responseWaits for approvalSuppress a patternKept in the audit logResults written back by the platformAgent command resultsPlaybook step resultsSigned intel bundles
Legit AI
  • Events and detections
  • Decisions by people
  • Waits for approval
  • Part of the platform

Read

Section titled “Read”

Every source lands on one schema, legit.event.v1, with the server’s own time of receipt, and goes through the same detection. An alert ties together the event, the rules it matched, the asset it happened on and the indicators it names.

Write back

Section titled “Write back”
  • Confirm: sets the status and adds to the alert’s timeline.
  • Dismiss with a reason: a reason is required, and dismissals are counted against the rule that fired, so a rule that is often wrong shows it.
  • Escalate: opens an investigation with the alert in it.
  • Request a response: isolating a host, stopping a process, quarantining a file or blocking an address waits for a second administrator, or for one person’s fresh code where the organisation works alone.
  • Suppress a pattern: from a dismissed alert, so the same thing stops opening alerts; the decision is kept in the audit log.

Read more: The alert queue, Detection rules, Isolation and process kill.

Written back by the platform

Section titled “Written back by the platform”

What the platform carries out comes back into the same graph: agent command results, playbook step results and the indicators of signed intelligence bundles. What was done sits next to why.