Huntstack Triage Verdict Agent

HuntStack Triage Verdict is the judgment layer for Microsoft Sentinel incidents raised by HuntStack analytic rules.

Every analytic rule HuntStack deploys ships together with its own follow-up hunt queries. When a rule fires, the HuntStack Triage Query Runner playbook executes those hunts against Microsoft Defender XDR Advanced Hunting and posts each hunt's query and results to the incident as comments. That gathering is deterministic KQL and consumes no Security Copilot compute. This agent reads that evidence and does the one thing that genuinely needs judgment: it decides what the evidence means.

The agent runs unattended. When the runner finishes posting evidence, the HuntStack Triage Verdict playbook fires on the incident comment event, labels the incident so it can only ever be judged once, submits the evidence to the agent, and posts the returned verdict back to the incident. No analyst has to open a console or type a prompt.

Agent tasks:

1. Read the follow-up hunt evidence already posted on the incident: hunt name, query, and result rows, or an explicit no-results or hunt-failed line.

2. Weigh corroborating against exculpatory results across every hunt for that rule.

3. Classify the incident and give the confidence, reasoning, and concrete next steps.

4. Treat a hunt that failed to run as unknown, never as exculpatory, and return needs-analyst rather than guess when the evidence cannot support a confident call.

5. After a true-positive or needs-analyst verdict, check whether the attacker kept access: newly registered devices, application and service principal changes, consent grants, mailbox forwarding and inbox rules, exfiltration signals, and endpoint persistence such as run keys, services, startup folder drops, scheduled tasks, and WMI subscriptions.

Inputs: a Microsoft Sentinel incident raised by a HuntStack analytic rule, with its title, severity, status, and labels; the follow-up hunt results the runner posted to that incident as comments; and, in chat, any incident, user, device, IP address, file hash, or email an analyst asks about.

Outputs: a machine-readable verdict on the first line - true-positive, false-positive, or needs-analyst, with confidence, reasoning, and next steps - then a short plain-language summary for the analyst who opens the incident, plus post-triage persistence findings on true-positive and needs-analyst verdicts.

The agent is read-only. It recommends; the HuntStack playbook performs every Sentinel write, so labels, comments, and status changes stay under your control.

Analysts can also use the agent in Security Copilot as a Level 1 investigation assistant. Its 67 read-only skills cover alert history, device posture and vulnerabilities, sign-in risk, password spray and MFA fatigue detection, directory changes, file reputation, IP activity, process and network analysis, and phishing blast radius.

Integrated Microsoft products: Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Security Copilot.