# Analysis Guidance Quick Setup Guide

## Overview

**Analysis Guidance** allows you to automatically assign investigation conclusions based on predefined conditions. When alerts match your configured criteria, Dropzone applies the appropriate conclusion—such as **Malicious**, **Suspicious**, or **Benign**—without requiring manual review.

Analysis Guidance helps standardize investigation outcomes, reduce repetitive analyst effort, and ensure consistent handling of common alert patterns.

### How Analysis Guidance Affects Investigations

With Analysis Guidance enabled:

* Investigation conclusions are automatically assigned based on your rules
* Default AI conclusions can be overridden using insight tags or scenario descriptions
* Similar alerts receive consistent conclusions across investigations
* Conclusion changes are applied automatically without analyst intervention

---

## Quick Setup

### Step 1: Navigate to Custom Strategies

1. In the Dropzone interface, open **Settings** from the left navigation.
2. Select **Custom Strategies**.
3. You’ll see the Custom Strategies management page with a **New Strategy** button.

---

### Step 2: Create or Edit a Strategy

* Click **+ New Strategy** to create a new strategy, or select an existing one to edit.
* In the **Create Strategy** modal:
  * Enter a unique, descriptive title (for example, *Automated Conclusion Rules*).
  * Click **Save**.

You’ll be taken to the strategy configuration page.

---

### Step 3: Configure Alert Filters

Alert filters define *when* your Analysis Guidance rules apply.

Configure one or more of the following filters:

* **Scenario**  
  Enter keywords that appear in alert descriptions (for example, *new device login*).
* **Attack Surface**  
  Select one or more surfaces:
  * Cloud
  * Network
  * Email
  * Identity
* **MITRE Tactic**  
  Choose applicable tactics such as:
  * Initial Access
  * Execution
  * Defense Evasion
  * Or **All**
* **Alert Source**  
  Select specific sources (for example, GuardDuty, Sumo Logic, Email) or **All**.

**Example Filter Configuration:**

* Scenario: *new device login*
* Attack Surface: *Identity*
* MITRE Tactic: *Initial Access*
* Alert Source: *All*

---

### Step 4: Configure Analysis Guidance

Scroll to the **Analysis Guidance** section of the strategy.

1. Select a **Guidance Type**:
   * **Insight Tag Rule**
   * **Scenario Description**
2. Click **+ Add Condition**.
3. Define the condition and the conclusion to apply.

---

## Understanding Insight Tags

**Insight Tags** are automatically applied labels that provide additional context during investigations.

Insight Tags can:

* Restrict or influence possible conclusions
* Provide additional context without changing outcomes

They allow domain-specific knowledge to be embedded into the AI’s decision-making process.

---

## Guidance Types

### Insight Tag Rule

Use this guidance type when conclusions should be set based on specific insight tags.

**Configuration:**

* **Has Insight Tags:** Select one or more tags (for example, *Blocked Activity*, *Malware*).
* **Then, set conclusion to:** Choose a conclusion:
  * Malicious
  * Suspicious
  * Benign
  * Inconclusive
  * Ignored

You can add multiple conditions using **+ Add Condition**.

**Example:**

* Has Insight Tags: *Blocked Activity, Potentially Unwanted Program*
* Then, set conclusion to: **Benign**

---

### Scenario Description

Use this guidance type when conclusions should be based on alert descriptions or behavioral patterns.

**Configuration:**

* **Matches Description:** Enter a descriptive pattern.
* **Then, set conclusion to:** Choose a conclusion type.

You can add multiple conditions using **+ Add Condition**.

**Example:**

* Matches Description:  
  *If the user agent indicates a new device type (Android, iPhone, Windows, Mac, Linux) that has not been observed for the user before*
* Then, set conclusion to: **Malicious**

---

## Conclusion Types

Analysis Guidance supports the following conclusions:

* **Malicious (Red)**  
  Confirmed threat or attack
* **Suspicious (Yellow)**  
  Potentially harmful activity requiring review
* **Benign (Teal)**  
  Legitimate or harmless activity
* **Inconclusive (Gray)**  
  Insufficient data to determine intent
* **Ignored (Gray)**  
  Activity that does not require further investigation

---

## Common Insight Tags

Frequently used insight tags include:

* Blocked Activity
* Potentially Unwanted Program
* Account Lockout
* Attack Simulation
* Authorized Scanner
* Conditional Access Block
* Consumer VPN Use
* Critical Asset

---

## Best Practices

### ✅ Do

* Use **Benign** for clearly legitimate activity (for example, blocked unwanted programs)
* Use **Malicious** for confirmed threats or well-understood attack patterns
* Use **Suspicious** for activity that warrants human review
* Test rules using representative alerts
* Consider organizational and environmental context

### ❌ Don’t

* Mark everything as **Malicious**
* Create overlapping or conflicting rules
* Ignore alert context when defining conclusions

---

## Example Analysis Guidance Configurations

### Insight Tag Rules

**Blocked Unwanted Programs**

* Guidance Type: Insight Tag Rule
* Has Insight Tags: *Blocked Activity, Potentially Unwanted Program*
* Then, set conclusion to: **Benign**

**Malware Detection**

* Guidance Type: Insight Tag Rule
* Has Insight Tags: *Malware*
* Then, set conclusion to: **Malicious**

---

### Scenario Description Rules

**New Device Login**

* Guidance Type: Scenario Description
* Matches Description:  
  *If the user agent indicates a new device type that has not been observed for the user before*
* Then, set conclusion to: **Suspicious**

**Suspicious Login Pattern**

* Guidance Type: Scenario Description
* Matches Description:  
  *If login attempts occur from multiple countries within a short time frame*
* Then, set conclusion to: **Malicious**

---

## What You’ll See in Your Investigations

After configuring Analysis Guidance:

* **Automatic Conclusion Assignment**  
  Conclusions are set automatically based on your rules.
* **Consistent Outcomes**  
  Similar alerts receive consistent treatment.
* **Reduced Manual Work**  
  Analysts no longer need to assign conclusions for common patterns.
* **Standardized Process**  
  Investigation outcomes align with documented team criteria.

---

## Next Steps

* **Start Simple**  
  Create one or two rules for your most common alert types.
* **Test and Monitor**  
  Observe how rules affect investigation outcomes.
* **Refine**  
  Adjust rules based on analyst feedback and evolving patterns.
* **Expand**  
  Add more sophisticated rules as your team becomes comfortable.