Ransomware Kill Chain Investigator Agent

Ransomware Kill Chain Investigator (RKCI) is a security-focused, read-only ransomware investigation agent that helps organizations analyze across Microsoft Defender and Microsoft Sentinel incidents with speed and confidence. It correlates evidence across users, devices, and indicators, maps activity to the ransomware kill chain, and produces an evidence-based investigation report with prioritized response actions.

The agent is designed for SOC analysts, incident responders, and security operations leaders. It supports both direct execution and guided chat for follow-up analysis.

The agent consumes Microsoft security signals such as Microsoft Defender incident data, Microsoft Entra user and sign-in context, Threat Intelligence data for hashes, IPs, and domains, optional Microsoft Intune device posture, and targeted KQL-based hunting results for ransomware behaviors.

If some signals are unavailable due to permissions, tenant configuration, unsupported dependencies, or retention limits, the agent runs in best-effort mode and reports data gaps and confidence impact instead of failing.

Investigates ransomware-related incidents, correlates evidence into a kill chain view, enriches users, devices, and indicators, validates hashes, domains, and IPs, runs evidence-led hunts, generates prioritized containment, eradication, and recovery guidance, and supports guided analyst interaction through chat.

A consolidated ransomware investigation report including:

Estimated consumption varies with incident complexity, entity volume, available telemetry, and required enrichment.

Expected consumption per run:

Rule of thumb:

Version 3.3.2

Change log