This chapter serves four connected activities of a security operation: engineering detections, investigating what they raise, hunting for what they miss, and turning intelligence about threats and vulnerabilities into decisions. It treats tools of all four kinds. The artefacts are the records that carry a detection from idea to retirement (DET-*), an investigation from alert to closed case (CASE-*), a hunt from hypothesis to conversion (HNT-*) and an intelligence item to a requirement (INTEL-*). The own tools are few: the series gives no software for this activity, only records and one Python interface sketch. The third-party tools are the platforms and open standards on which the records rest, among them Sigma, STIX and TAXII, MITRE ATT&CK, the exploit-prediction and exploited-vulnerability sources, and the SIEM, EDR and case-management categories. The methods are the practical guides that the originating books attach to the artefacts. The tools come chiefly from AI Red Team (Chapters 2, 11, 18 and 19) (4, Nordqvist, 2026) and AI Blue (Chapters 2, 5, 6, 8, 9 and 12) (8, Nordqvist, 2026), with the detection record for AI agents and the decay estimate from AI Purple (Chapters 3 and 12) (9, Nordqvist, 2026), the delegated patch playbook from The Transformed Security Architect (Chapter 10) (6, Nordqvist, 2026) and the first detection platform sketch from Architecture as Code (Chapter 9B) (1, Nordqvist, 2025).
The chapter answers two questions. Which formats and records carry a detection from idea to retirement? And how is an AI-assisted investigation recorded? The short answers are these. A detection is a versioned record with logic in a portable format, a mapping to adversary technique, tests, an owner, a cost budget and a review date; a case is a record in which every conclusion traces to evidence, and in which it is visible who or what reached it. The chapter does not repeat the reasoning of the originating books. It says what each tool is, when to reach for it, what it needs and what it produces, and where the book that defines it gives the rest.
Each principal tool has an entry in the format fixed in the chapter authoring guide. Where an originating book gives a full template, the chapter quotes it from the manuscript of that book as it stands at the date of this book, removing only whole fields, and says so. The records are illustrative in the originating books: they use the fictional organisations Nordvik Region and Hansa Mutual and invented dates. They are shown as a form to adapt, not as evidence that any organisation ran them. Third-party tools are described only as far as their own documentation or standard allows; what the series does with them is attributed to the series.
Primary topics explored
- How to read the entries
- Detection records and rules
- Case records and the platforms around them
- Playbook records at the boundary with response
- Hunt records
- Intelligence and vulnerability data
About Tools
Tools is a companion to The Transformed Architecture. It collects the tools that Books 1 to 10 describe in one reference, organised by what the practitioner is doing: artefacts (templates, manifests, records), own tools, third-party tools and standards, and methods. Each entry says what a tool is for, when to use it, what it needs and produces, and where the book that defines it explains the reasoning. The book covers choosing, adopting and retiring tools, architecture and delivery, governing AI, securing and testing, operating, agents and autonomy, and people, organisation and society, for European enterprises and public authorities. It comes with a template library, an inventory, three web tools and the Toolbox Maturity Method.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect, AI Boss, AI Blue, AI Purple and AI Operations.
Architects and security architects, CIOs and CISOs, platform and operations leads, heads of governance, risk, compliance and third-party risk, AI governance and AI platform teams, red, blue and purple team leads, boards and management bodies, procurement and vendor managers, supervisors and auditors, works councils and unions, data protection officers, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 12: Detection, Investigation and Intelligence Tools in Tools gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Securing and Testing” and is one of 29 drawn from the manuscript.