Investigation turns an alert into a verified account of what happened: how far an intruder or a misuse reached, which data and identities were touched, what is still unknown, and what the organisation must do and report as a result. This chapter describes B3 Investigate as AI transforms it. AI now queries data lakes, assembles timelines, proposes hypotheses and drafts the case narrative, and the investigator's work shifts from searching and writing towards steering, challenging and verifying. The chapter treats four hazards that follow from that shift: evidence that the adversary can write, narratives that are fluent but ungrounded, loss of chain of custody, and the duties that apply when the activity under investigation is a person's. It shows how evidence is preserved, how reasoning is recorded and how an investigation stays reproducible without the AI. It starts where the triage of Chapter 7 ends, with a case, and hands over to the containment decisions of Chapter 10.
An investigation is easiest to understand through one case. A detection fires at Hansa Mutual because a forwarding rule to an external address has been created in a claims correspondence mailbox at the Dutch subsidiary. Triage has established that the alert is real. The questions that make it a case follow. Which session created the rule? Did anything leave the mailbox before the rule was found? Is this one account or the first of several? Each is answered in the same way, and that way is the investigation loop: a question, the data that bears on it, a hypothesis, a test that would separate the hypothesis from its rivals, a conclusion, and a record of all five. The loop repeats until the questions that matter for containment, reporting and recovery are answered or declared unanswerable.
The loop has not changed with AI. What changed is who does which part of it, and what must be checked afterwards. NIST's incident response profile is written against the CSF 2.0 Functions (19, NIST, 2025), and in those terms B3 serves the CSF Detect and Respond Functions: in this book it receives from B2 Detect and supplies B4 Respond (Chapter 2). The table shows the loop with the AI's contribution marked.
Primary topics explored
- The investigation loop
- Timelines and queries
- Forensics and chain of custody
- Hostile content in evidence
- Reproducibility
- Investigating people
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 8: Investigate: Hypotheses, Timelines and Evidence with AI in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Craft” and is one of 32 drawn from the manuscript.