Abstract
An autonomous security incident analysis pipeline runs deterministic probes that establish, per customer tenant, which telemetry sources are actually available before and during each analysis, and constrains the pipeline's permissible conclusions using the probe results. Probes include a configuration-presence gate for third-party endpoint tooling, a single-row endpoint-inventory query whose three outcomes disambiguate telemetry-available, licensed-without-devices, and not-licensed, a rolling census of log tables that actually ingested data, and explicit consent-gap detection for API scopes. For incident classes whose disposition depends on endpoint evidence, an unavailable-telemetry result caps the analysis confidence and converts an autonomous benign closure into an escalation. A minimum-coverage rule requires a threshold count of successful investigation queries, on distinct angles, before any terminal verdict. Autonomous closure is additionally two-keyed: the analysis must independently recommend no escalation AND a per-tenant severity-and-confidence policy table must match.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
AlpenShield GmbH, "Telemetry-Coverage Probes That Structurally Gate Autonomous Disposition of Security Incidents", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/11427