Cross-device Deep Investigation

The core question in cross-device deep investigation is: when facing an alert lead, how can an Agent collect data across multiple devices and connect fragmented data into a complete attack chain?

Flocks encapsulates "cross-device data collection -> time-window alignment -> attack chain reconstruction -> traceability report" as an independent sub-agent, which the main Agent Rex invokes as needed during triage. The sub-agent has both direct API access and browser operation capabilities. It prioritizes API access; when API data is unavailable, it falls back to the browser approach. This transition is seamless to upper-level workflows.

Scenario Overview

Alert triage can determine whether an alert is real, but it does not resolve the following questions:

Does the outbound connection seen by NDR in the same time window correspond to the process seen by HIDS?
Did the firewall allow it? What files were left on the host?
Which machine was the initial entry point, and where did lateral movement go?

These questions require joint data collection across multiple devices and timeline alignment. A manual cross-device investigation usually takes a long time. Flocks can significantly shorten data collection, alignment, and summarization.

The difference from host incident forensics is that host forensics collects deep evidence from a single machine, while cross-device investigation correlates evidence across peripheral devices. They are usually used together: after cross-device investigation finds a suspicious host, a host forensics Agent is delegated to investigate on the machine.

Inputs and Outputs

Typical Inputs

One credible alert, selected after alert triage
A group of suspicious IPs / hosts / processes / domains
A time window, usually from +/-30 minutes to +/-1 day around the alert

Typical Outputs

Cross-device evidence set: raw records hit on each device, with timestamps
Attack timeline: sorted by time, including initial compromise, lateral movement, C2 outbound connections, and other key nodes
Standard traceability report: Markdown / JSON persisted to Workspace
Follow-up recommendations: whether host forensics, blocking, or expansion is needed

Prerequisites

Dependency	Requirement
Model	The default model is sufficient; reasoning models perform better for timeline reconstruction. See Model Configuration
Multi-device integration	At least two of NDR / HIDS / EDR / firewall / asset platform are integrated. See Internal Security Product Integration
Browser fallback	If some devices only have web pages, make sure the browser tool is available. See Browser Automation and Web Login
Time synchronization	Device clocks must be synchronized, such as through NTP, otherwise the timeline will shift
Asset dictionary	Optional. CMDB integration is recommended for reverse lookups among IP, hostname, and owner

Steps (WebUI)

Step 1: Start a Session and Describe the Investigation Goal

Enter Session Management -> + New Session and provide Rex with the available leads:

"Investigate suspicious behavior for 10.10.x.x from 2026-03-28 08:00 to 10:00. Align records from NDR / HIDS / firewall and give me a complete timeline."

The more structured the lead is, such as IP, time window, and suspicious behavior type, the more accurately Rex can split and dispatch concurrent subtasks.

Step 2: Rex Switches to the Cross-device Investigation Sub-agent

After Rex identifies this as a cross-device linkage request, it delegates to the cross-device investigation sub-agent. This is essentially a multi-Agent architecture:

Rex handles task splitting and timeline summarization
The cross-device investigation sub-agent has an independent system prompt and focuses on data collection, alignment, and cross-checking
Results flow back into Rex's context for follow-up actions

Step 3: Concurrent Data Collection Across Devices

The sub-agent launches queries against connected devices in parallel:

Alert devices: NDR, TDP, XDR filtered by time window
Host devices: HIDS / EDR pulls processes, network connections, and login records
Boundary devices: firewall pulls allow / deny logs
Web-only devices: browser tool logs into consoles and extracts data

All raw data is written to the Workspace date directory, such as 3-28/cross/ndr.json and 3-28/cross/hids.json, for later review and scheduled reuse.

Step 4: Time-window Alignment and Cross-checking

The sub-agent normalizes records from each device by timestamp and performs:

Time-window alignment: unify to the same time zone and narrow to relevant segments around the alert
Entity alignment: connect records for the same IP / hostname / process across devices
Causal inference: identify event ordering, trigger relationships, and key nodes such as initial compromise, lateral movement, and outbound connections

Step 5: Generate a Traceability Report

The final output is a structured report persisted in Workspace:

Attack timeline, in ascending time order
Evidence matrix, showing which device record supports each conclusion
Impact scope, listing connected assets
Recommended actions, such as whether to escalate to host forensics or block traffic

Step 6: Optional: Continue Delegating Downstream Actions

After Rex reads the report, it can:

Delegate Host Inspection / Incident Forensics to suspected compromised hosts
Pass key IOC to Threat Intelligence and IOC Triage
Solidify the full chain as a scheduled task, periodically rescan the time window, and notify when new related alerts appear

Real Case Walkthrough: Correlating Cross-Device Events for a Suspected WebShell Attack

Using a typical "alert triage -> cross-device investigation -> host forensics" linkage as an example:

Stage	Rex / sub-agent action	Output / notes
Trigger	Alert triage identifies a suspected WebShell upload attack on `10.10.x.x`	Enters a state requiring cross-device corroboration
Dispatch	Rex delegates to the cross-device investigation sub-agent	Sub-agent takes over; Rex only summarizes
Data collection	Concurrently queries NDR (outbound IP / URL), HIDS (process tree / file changes), and firewall (allow records)	Three raw data files persisted to `3-28/cross/`
Alignment	Filters by the 08:15+/-10 min time window and finds matching NDR outbound activity + HIDS new process + firewall allow time	Timeline begins to form
Expansion	Finds that the same source IP also hit two other hosts	Lateral movement suspected
Report	Produces a three-stage timeline: "initial compromise -> WebShell upload -> internal lateral movement"	Structured Markdown
Linkage	Rex continues delegating the host forensics Agent to the suspected compromised host to verify whether the WebShell file actually exists	Evidence loop closes

Output Example (Report Fragment)

text

Investigation subject: suspected WebShell attack on 10.10.x.x from 2026-03-28 08:00 to 10:00
Timeline:
  08:12  NDR  Outbound connection to 109.x.x.x:443, abnormal HTTP 400 Bad Request response
  08:14  Firewall  Allowed 109.x.x.x -> 10.10.x.x:80 (inside allowlist)
  08:15  HIDS  New process /var/www/html/.cache/cmd.php (php-fpm child process)
  08:17  HIDS  Process creation chain: php-fpm -> sh -> wget xxx
  08:22  NDR   Same source IP hit 10.10.x.y and 10.10.x.z (suspected lateral movement)

Evidence matrix:
  - WebShell upload: NDR(08:12) + HIDS(08:15) corroborate each other
  - C2 outbound connection: HIDS(08:17) wget command line + NDR outbound traffic

Recommendations:
  - Delegate the host forensics Agent to 10.10.x.x to verify cmd.php
  - Include 10.10.x.y / 10.10.x.z in expansion
  - Add 109.x.x.x as a candidate for perimeter blocking

Continuous Operation and Scheduled Tasks

Cross-device investigation itself is event-driven and not suitable for hourly indiscriminate scanning. The following derived tasks are suitable for Task Center:

Task form	Description
Rescan key alerts	Every 2 hours, rescan high-confidence alerts in a recent time window, automatically run one cross-device investigation, and push when new correlations are found
Compromise-scope monitoring	Add confirmed compromised host IPs to an "hourly cross-device spot check" list and watch later outbound connections and logins
False-positive regression	Sample closed alerts from the previous 24 hours every day, cross-device review them, and evaluate false-positive rate

Boundaries and FAQ

Question	Handling
Device clocks are not synchronized, so the timeline is wrong	First fix time zone at the integration layer; if uncertain, the Agent uses NDR time as the baseline and aligns other devices by manually annotated offset
A device only has Web pages and no API	Enable the browser tool as a fallback. See Browser Automation and Web Login
Concurrent queries affect device stability	Add concurrency limits and backoff retries at the Agent / tool layer, or investigate in batches by time window
Report is too long to read	Constrain the Agent system prompt to the three sections "timeline + evidence matrix + recommendations" and trim excess content
Want the Agent to block automatically	Not recommended. Flocks focuses on triage / evidence output; blocking actions should still be confirmed by humans and handed to downstream systems

3.3 Messaging & Alerting Integrations

4.7 Workflow

4.8 Devices

5.3 Alert Denoising

5.4 Alert Triage