Incident narratives
Vigil explains what happened, which signals matter, and why the incident deserves attention.
Use case
AI security investigation for cloud incidents
Turn suspicious activity into an evidence-backed incident narrative with likely impact, affected assets, and recommended response steps.
Capabilities
What Flarehawk gives this workflow
Each use case starts from Cloudflare telemetry and ends with evidence your team can use.
Evidence clustering
Related requests, detections, IP behavior, assets, and timing are grouped into one investigation view.
Response-ready output
Each investigation can include practical actions a security or engineering lead can review.
Context
How this workflow works in practice
Flarehawk keeps autonomous investigation concrete by connecting AI output to security evidence and reviewable action.
From alert to story
Instead of opening with a raw alert, Flarehawk starts by reconstructing the sequence of suspicious activity.
Evidence remains inspectable
AI output stays tied to Cloudflare evidence such as paths, IPs, Ray IDs, rule context, and historical baselines.
Built for accountable review
Recommendations are written for humans to approve, reject, or adapt before changes are made.
Workflow
From setup to investigation
The same core loop supports analytics, autonomous investigation, and retention-driven evidence review.
1
Detection logic flags a suspicious behavior pattern.
2
Vigil gathers related telemetry and asset context.
3
The investigation explains the timeline, likely intent, and affected surface.
4
Flarehawk proposes response steps with supporting evidence.
5
Your team reviews the plan and tracks recurrence.
Related
Continue with autonomous SOC
These pages connect the search path from category evaluation to the concrete Flarehawk workflow.
FAQ
Use-case questions
Does Flarehawk replace a human investigator?
No. Flarehawk speeds up investigation by collecting context and writing the first evidence-backed narrative for review.
What evidence does Vigil use?
Vigil uses detections, Cloudflare event details, asset context, baselines, and related activity stored in Flarehawk.