Jump to a page or a control
Detect · Optimized tier · Security Operations
The bank uses AI-enabled tooling for threat hunting and triage, with a person confirming every action.
Status
Evidence indicatesAll 2 items support it and are fresh.
Exposure
Medium
2 evidence items from 2 sources
CCSA · Detect
FoundationalNot blocking this domain's next tier.
Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.
ev-de03-1
Automated hunts run daily; analysts confirm every escalation
CrowdStrike Falcon · telemetry · collected 3 h ago (Oct 15, 2026 · 12:02 UTC) · limit 168 h
Powered by Mesh APIGET /scheduled-reports/entities/scheduled-hunts/v1085f986c8cfce0ea882c4012a337e6e1977e40c8cad26b44cc2d7704657ac620
ev-de03-2
SOC copilot drafts the first note on 71% of alerts, through the gateway
ServiceNow ITSM · export · collected 26 h ago (Oct 14, 2026 · 13:02 UTC) · limit 168 h
GET /api/now/table/sn_si_incident?sysparm_query=u_ai_triage=true7107fc359c3ae38b0da0b6d00c295ce14a0dc1b3564dc81f692910bf1b26f205