> For the complete documentation index, see [llms.txt](https://open-2v.gitbook.com/url/docs.salemcyber.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://open-2v.gitbook.com/url/docs.salemcyber.com/welcome/automated-cyber-alert-investigations.md).

# Automated Cyber Alert Investigations

## Salem Alert Investigation Overview

Salem was specifically designed to automate cyber investigations.  Every alert sent to Salem will be automatically investigated.  The investigation process includes the following components:

<table><thead><tr><th width="164.74786376953125">Component</th><th>Role</th></tr></thead><tbody><tr><td>Parsing</td><td>Format and normalize data from the alert.  Salem is capable of accepting alerts in any modern alert data format.  The parsed alert will be rendered in a JSON format within Salem.</td></tr><tr><td>Enrichment</td><td>Salem collects new information to add to an alert to help support the investigation.  Some enrichment will happen automatically, and other enrichments will be selected by Salem based on what additional information is needed to complete the investigation.</td></tr><tr><td>Contextualization</td><td>Salem understands the context surrounding activity, accounts, systems, programs and data.  Salem strives to know as much as possible about the objects and entities associated with a cyber alert.  This helps Salem gain a full picture of what has occurred.<br><br>Salem leverages both default contextual understanding was well as organizational context learned over the course of prior Salem investigations.</td></tr><tr><td>Evaluation</td><td>Leveraging the alert investigation context, Salem generates a threat score using a sophisticated AI model that understands the interrelationship between the objects and entities associated with an alert.</td></tr><tr><td>Response</td><td>At the conclusion of an investigation, Salem directs response actions, including Salem Threat Notifications in chat, and other organization configured response actions.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://open-2v.gitbook.com/url/docs.salemcyber.com/welcome/automated-cyber-alert-investigations.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
Component	Role
Parsing	Format and normalize data from the alert. Salem is capable of accepting alerts in any modern alert data format. The parsed alert will be rendered in a JSON format within Salem.
Enrichment	Salem collects new information to add to an alert to help support the investigation. Some enrichment will happen automatically, and other enrichments will be selected by Salem based on what additional information is needed to complete the investigation.
Contextualization	Salem understands the context surrounding activity, accounts, systems, programs and data. Salem strives to know as much as possible about the objects and entities associated with a cyber alert. This helps Salem gain a full picture of what has occurred. Salem leverages both default contextual understanding was well as organizational context learned over the course of prior Salem investigations.
Evaluation	Leveraging the alert investigation context, Salem generates a threat score using a sophisticated AI model that understands the interrelationship between the objects and entities associated with an alert.
Response	At the conclusion of an investigation, Salem directs response actions, including Salem Threat Notifications in chat, and other organization configured response actions.