Skip to main content

Using Sara: Your AI-Powered L1 Analyst

Saad Noor avatar
Written by Saad Noor
Updated over 2 weeks ago

Overview

Sara is SIRP’s AI-powered Level 1 analyst, designed to automate and accelerate routine incident handling tasks. Trained using contextual prompt engineering, Sara understands incident data and responds intelligently—reducing manual overhead and improving consistency across SecOps workflows.

As of now, Sara assists with:

  • Generating incident analysis summaries

  • Suggesting remediation steps

  • Recommending workflow tasks

All actions are available directly from within the investigation or incident interface, and users can insert, edit, or summarize the AI-generated content based on their preferences.

Accessing and Using Sara’s Features

1. Generating an Incident Analysis Summary

To generate an incident analysis summary using Sara:

  1. Navigate to an Investigation or Incident.
    From the list of investigations or incidents, open any existing incident/investigation.

  2. Click the Edit Icon.
    Located in the top-right corner of the incident panel.

  3. Scroll to the "Incident Analysis" Field.
    This section contains an AI icon that indicates Sara's availability.

  4. Click the AI Icon.
    Sara will analyze the incident data and generate a structured analysis summary.

  5. Review and Approve the Summary.
    If the generated response is suitable, click Insert to apply it to the field.

  6. Optional: Summarize Further.
    After insertion, hovering over the AI icon reveals an additional option: Summarize this response. This refines the content for greater brevity.

  7. AI Summarization for Manual Inputs.
    If the field contains manually entered content, users can still invoke AI to summarize the existing information.

2. Generating Remediation Details

  1. Scroll to the Bottom of the Incident Screen.
    Locate the Remediation tab, visually marked with the SIRP AI icon.

  2. Click on the “Incident Remediation Details” Field.
    An AI icon will be available within this field.

  3. Click the AI Icon.
    Sara will generate remediation guidance based on the incident context.

  4. Summarize Option Available.
    Users can further shorten the content using the Summarize feature, just like in the Analysis section.

3. Creating Workflow Tasks with Ask Sara

  1. Open the “Tasks” Tab from the incident view.

  2. Click “Ask Sara.”
    This triggers AI generation of a list of actionable tasks for incident remediation.

  3. Select Desired Tasks.
    Use checkboxes to select the tasks relevant to the current investigation.

  4. Click “Insert.”
    The selected tasks are added to the task list and marked as Unassigned by default, ready for further assignment.
    ​

Coming Soon: Unified Interface for Sara

We're working on a unified interface that consolidates all of Sara’s capabilities into a single, streamlined pane. This new interface will come as part of a redesigned Incident View Screen, offering a more intuitive and centralized experience for engaging with AI assistance during incident response.

Did this answer your question?