Ransomware rarely announces itself first
By the time a security tool raises an alert explicitly labelled "ransomware," the encryption has usually already started, and containment has become damage control. The alerts worth investigating properly are the precursors: a scheduled task nobody registered, a spike in file-rename activity on a single host, a login from an account that has never touched that server before. Individually, each of those looks like noise. Together, in the right order, they look like the early minutes of an incident.
This is the case study we use most often internally to explain what an autonomous investigation actually does, because it touches every stage of the pipeline: triage, identity context, endpoint behaviour, threat intelligence correlation, and a containment recommendation with the evidence attached.
Stage one: triage decides whether this is worth a full investigation
The Triage Agent is the first thing every alert meets. Its job is not to solve the case — it is to decide, in under a second, whether this looks like a genuine threat or a false alarm, and to attach a confidence score to that decision so the rest of the pipeline (and any human reviewing the eventual report) knows how certain the system is. A single suspicious file rename might not clear the bar on its own. A file rename combined with a process spawning from an unusual parent, on a server that does not normally see interactive logins, does.
False alarms are closed here with documented reasoning rather than silently discarded — which matters, because "the system decided this was nothing" needs to be auditable, not just trusted.
Stage two: building the picture of who and what is involved
Once an alert clears triage, the Entity Enrichment agent pulls context on every account, device, and IP address named in it — recent identity activity, whether the device has deviated from its normal software baseline, whether the source IP has any history. This is the step that turns "a file got renamed" into "a service account that has never authenticated interactively did so twelve minutes before the file activity started, from a device that does not usually run this process."
In parallel, the Hunting agent looks for related activity elsewhere in the environment — the same indicators, the same technique, on other hosts — because ransomware precursors are frequently not isolated to one machine.
Stage three: matching the behaviour to known technique
Threat Intelligence correlation checks the observed behaviour against known indicators and technique patterns, mapped to MITRE ATT&CK. This is where "file rename plus unusual service account login" gets classified against a specific technique family rather than treated as a one-off anomaly — which matters for the containment recommendation that follows, because the right response differs depending on whether this looks like commodity ransomware, a targeted intrusion, or an insider misuse case that merely resembles one.
Stage four: a recommendation, not a silent action
The investigation concludes with a written finding and a recommended containment step — isolate the device, revoke the session, disable the account — with the full evidence chain attached: what was observed, what context was pulled, what it was matched against, and why that recommendation follows from it. Whether that action fires automatically or waits for a human sign-off is a configuration choice each customer makes for their own environment; urgentic does not assume every customer wants the same level of automation on the response side that it uses on the investigation side.
What does not vary is the speed of getting to that recommendation. Because the pipeline runs the same way at 3am on a Saturday as it does at 10am on a Tuesday, the gap between a precursor appearing and someone — or something — being told to act on it stops depending on who is on shift.