AI in DFIR 101: Why You Should Use AI for Planning
Brief
The planning phase of an investigation is where GenAI can provide a lot of value. Whether it’s writing a SOC playbook, assigning tasks during an incident, or writing a search warrant, a plan needs knowledge and creativity to know where to find evidence. GenAI can supplement your knowledge to make sure you find the evidence.
This post walks through the three phases of planning and shows where a deterministic playbook is enough, and where AI provides value.
The Planning Phase
Investigations start with a set of questions that need to be answered and the planning phase is where you turn those questions into a set of data to collect (endpoints, logs, etc.) and ideas about how to analyze the data. As an investigation occurs, you’ll learn new things and likely come back to mini-planning sessions.
For example, a malware investigation may ask “Was data exfiltrated?”