From Logs to Living Timelines: AI-Assisted Incident Response in Hybrid Cloud Using OCSF

From Logs to Living Timelines: AI-Assisted Incident Response in Hybrid Cloud Using OCSF

Speakers: Dr. Stephen Coston (Lead Security Architect, Centene); William Rodriguez (SOC Director, Centene)

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=1kH0Osys45k

Overview

In the rapidly evolving landscape of cybersecurity, incident response teams face an escalating barrage of challenges, from the proliferation of new attack surfaces in hybrid cloud environments to the sheer volume and inconsistency of log data. This presentation by Dr. Stephen Coston, Lead Security Architect, and William Rodriguez, SOC Director at Centene, addresses these critical pain points by introducing an innovative approach to AI-assisted incident response. Their talk, "From Logs to Living Timelines: AI-Assisted Incident Response in Hybrid Cloud Using OCSF," illuminates a practical framework for leveraging artificial intelligence to augment, rather than replace, human analysts, thereby compressing the incident triage cycle and enhancing the reliability of forensic investigations.

The core of their solution revolves around standardizing disparate log sources using the Open Cybersecurity Schema Framework (OCSF) and building an AI-powered "living timeliner." This tool not only normalizes and enriches vast quantities of security data but also adheres to stringent evidentiary standards such as Darbert, Fry, and Durant, ensuring that the generated timelines are auditable and legally defensible. By focusing on human-centered AI, Centene aims to equip security operations centers (SOCs) with the capabilities to navigate complex investigations more efficiently and accurately, ultimately fostering greater trust in AI-driven insights within a regulated environment.

This talk is particularly significant for any organization grappling with the complexities of hybrid cloud security, the integration of AI into security operations, or the imperative to maintain high standards of evidence and accountability in incident response. It offers a pragmatic blueprint for transforming chaotic log data into coherent, actionable intelligence, demonstrating how targeted AI applications can profoundly impact a SOC's operational speed, analytical depth, and overall effectiveness without sacrificing human oversight or trust.

Background

▶ Watch: Introduction and SOC operational challenges (0:00)

The modern security operations center is a crucible of challenges, constantly battling an expanding attack surface, evolving threat vectors, and an overwhelming influx of data. William Rodriguez, as a SOC Director, articulates the fundamental needs of analysts: understanding "what bad looks like" in the context of new technologies like cloud and AI, and performing consistent, sound triage and analysis. Traditional methods often fall short. Pentester reports, while valuable, rarely provide the granular log visibility analysts need to recognize attacks in real-time. Case handling reviews, though crucial for quality assurance and feedback, are time-consuming manual processes that supervisors struggle to maintain.

A significant impediment to effective incident response is the inherent messiness of log data. Inconsistent time fields, varying time zones, poorly documented logs, and gaps in evidentiary support undermine investigations, leading to prolonged triage times and the risk of analysts "running in circles." Custom logs, diverse source IPs, and user identifiers further complicate correlation, making it difficult to piece together a coherent narrative across an enterprise's sprawling infrastructure, especially in hybrid cloud environments where AWS, Azure, and other SaaS logs differ fundamentally.

The rapid adoption of AI introduces its own set of complexities and risks. While AI promises to fill gaps, increase productivity, and improve quality, its integration must be carefully managed. The speakers highlight the dangers of "shadow AI," where employees use unapproved AI solutions, potentially exposing sensitive company data to third parties through middlemen extensions, often without awareness. This sprawl necessitates robust governance, monitoring, and control mechanisms. Crucially, the outputs of AI, particularly in security, must be testable, show error rates, be published and peer-reviewed, and be generally accepted in the community – standards derived from legal precedents like Darbert, Fry, and Durant. Federal evidentiary rules, specifically Rule 707 (which refers to AI as a potential expert witness) and Rule 702 (the foundation of Darbert), underscore the need for AI-generated insights to be transparent, traceable, and defensible in any scrutiny. Without these foundational principles, AI outputs risk being as unreliable as "my cousin saying that he read it on social media."

Key Findings

▶ Watch: Evidentiary standards and OCSF for consistent timelines (8:00)

The central contribution of this talk is the development and implementation of an AI-assisted incident response framework centered around a "living timeliner" that addresses the aforementioned challenges. This framework dramatically compresses the triage cycle and enhances investigative reliability through several key findings:

1. Standardized Log Normalization with OCSF: The adoption of OCSF (Open Cybersecurity Schema Framework) as a vendor-agnostic standard is crucial. It enables the ingestion and normalization of diverse log sources—from host-based artifacts to cloud-specific logs (AWS, Azure, SaaS, custom)—into a consistent format. This standardization, including conversion of all timestamps to UTC, eliminates a major source of investigative friction and facilitates correlation across hybrid environments.
2. AI as an Augmentation, Not Replacement: A core principle is that AI serves to augment human analysts, focusing on pattern recognition, clustering, and data digestion, rather than replacing the critical human judgment layer. This approach acknowledges the current limitations of AI, particularly the risk of hallucinations, and emphasizes a human-in-the-loop model to validate AI outputs and prevent false investigations.
3. Evidentiary Soundness and Trust: The solution is built with a strong emphasis on legal and forensic standards. By incorporating the principles of Darbert, Fry, and Durant, the timeliner ensures that its methodology is testable, transparent, traceable, and accepted within the technical community. This commitment to evidentiary reliability is foundational for building trust in the tool's findings, especially in regulated environments.
4. Automated Timeline Generation and Enrichment: The "living timeliner" automates the arduous process of constructing incident timelines. It not only normalizes logs but also enriches them with open-source intelligence (OSINT) from sources like VirusTotal and OTX, and maps events to the MITRE ATT&CK framework. This automation provides analysts with a pre-contextualized, cohesive narrative, allowing them to focus on high-level analysis and decision-making.
5. Chain of Custody and Accountability: A critical design feature is the preservation of chain of custody. The AI never directly touches the original evidence; instead, it operates on the normalized timeline. The system records the location and hash of the original evidence, ensuring its integrity. Furthermore, the framework advocates for full logging of AI tool usage within the security information and event management (SIEM) system, providing an auditable trail for AI actions and outputs.

These findings collectively present a robust and practical solution for modern incident response, addressing both the technical challenges of data heterogeneity and the operational imperative for speed, accuracy, and defensibility.

Technical Deep Dive

▶ Watch: AI as augmentation and crucial human validation (16:00)

The technical architecture of Centene's AI-assisted incident response system is designed for robustness, scalability, and evidentiary integrity, primarily leveraging OCSF for data standardization and AI for intelligent augmentation.

At the ingestion layer, the system is engineered to handle a multitude of log sources, including traditional host-based artifacts (which tools like SANS Log Timeline excel at), as well as diverse cloud and SaaS logs (e.g., AWS, Azure, custom application logs, API keys, AI solution chunk IDs). The critical component here is the normalization engine, which applies the Open Cybersecurity Schema Framework (OCSF). OCSF was selected over alternatives like ECS (Elastic Common Schema) due to its perceived industry currency, active development, and robust versioning capabilities. This versioning is crucial for maintaining backward compatibility during stream processing, preventing schema changes from breaking ingestion pipelines—a common pain point for engineers.

Upon ingestion, OCSF schema is applied, and all timestamps are converted to Coordinated Universal Time (UTC). This uniform timestamping is vital for accurate correlation across geographically dispersed teams and diverse systems, effectively resolving issues stemming from inconsistent time zones and formats, including the notorious Epoch times from Linux systems that often "stumble up almost every good analyst." The normalization process also addresses the challenge of raw log data being unintelligible to AI models; just as a raw registry hive needs a parsing tool before analysis, raw security logs need OCSF normalization before AI can effectively process them.

The AI component is strategically positioned as an augmentation layer. It does not replace the analyst but rather enhances their capabilities by performing computationally intensive tasks such as pattern recognition and clustering. Once the logs are normalized and timestamped, the AI processes this structured data to identify related events, group them into logical clusters, and map them to the MITRE ATT&CK framework. For instance, it might identify a series of events as "reconnaissance," "lateral movement," or "exfiltration," providing a high-level overview that dramatically accelerates the initial triage phase. Dr. Coston noted that training the AI on just three log sources cost only $3 in tokens using a personal API with ChatGBT, highlighting the potential for cost-effective customization to avoid unnecessary token consumption.

A critical design principle is that the AI never touches the original evidence. Instead, it operates on the normalized, OCSF-compliant timeline. The tool meticulously records the location and hash of the original evidence, maintaining a stringent chain of custody. This ensures that the integrity of the raw data is preserved, which is paramount for forensic soundness and legal defensibility. The system also integrates with open-source intelligence (OSINT) tools like VirusTotal and OTX, enriching the normalized data with external threat intelligence to provide additional context for suspicious indicators.

The output of this process is presented through a Graphical User Interface (GUI), offering analysts a coherent, enriched, and pre-contextualized timeline. This "living timeline" can be regenerated with new data as an investigation evolves, allowing for dynamic adaptation to new findings without manual recalculation. For reporting and further analysis, the system provides robust export capabilities, allowing data to be saved in formats like CSV. This enables seamless integration with business intelligence tools such as Databricks, PowerBI, or Copilot for advanced visualization and reporting, addressing the common frustration of poor export functionality in many security tools.

Finally, the framework incorporates comprehensive logging of AI tool activities into the SIEM. This ensures accountability, traceability, and visibility into how AI processes data and generates insights. In the event of an AI hallucination or an erroneous output, having these logs is crucial for understanding the root cause and defending investigative findings, a lesson learned from instances where other AI tools lacked such logging. This holistic approach ensures that the AI's contributions are not only powerful but also transparent and auditable.

Demo / Proof of Concept

▶ Watch: Explainable AI, logging, and MITRE ATT&CK integration (24:00)

While the presentation did not include a live, in-depth demo during the talk itself, Dr. Coston detailed the capabilities of the developed tool and confirmed its existence as a functional proof of concept. The "living timeliner" was demonstrated using synthetic data, specifically created from an actual alert scenario. This approach was chosen to circumvent compliance and risk concerns associated with uploading sensitive case data into external AI chatbots or non-company-owned tenants, reinforcing a commitment to data security and privacy.

The demonstrated functionality showcased the tool's ability to ingest these synthetic logs, apply the OCSF schema for normalization, and convert all timestamps to UTC. This normalized data then underwent further processing, where the AI component performed its clustering and pattern recognition, mapping the identified activities to the MITRE ATT&CK framework. This mapping provides an immediate, high-level understanding of the attack progression, categorizing events into stages like reconnaissance, lateral movement, or exfiltration, which are then clearly listed within the interface.

Crucially, the tool enriches the timeline data by querying open-source intelligence (OSINT) platforms such as VirusTotal and OTX. This integration automatically pulls in contextual threat intelligence for observed indicators, providing analysts with a more comprehensive picture without manual lookups. The results are presented in a user-friendly Graphical User Interface (GUI), designed to make complex data digestible and actionable.

One of the highlighted features was the export capability, allowing the enriched timeline data to be exported in CSV format. This facilitates seamless integration with other analytical and visualization platforms, such as Databricks, PowerBI, or Copilot, enabling further custom reporting and dashboarding. This addresses a common pain point in incident response, where poor export options often necessitate cumbersome manual data extraction or screenshots for reports.

Dr. Coston also mentioned that all the underlying scripts for this solution are publicly available on GitHub, and an 8-minute video demonstrating the GUI and its functionalities is accessible on YouTube. This commitment to open-source sharing allows other organizations to inspect, learn from, and potentially adapt Centene's approach, fostering community collaboration in developing robust AI-assisted security tools.

Defensive Implications

▶ Watch: Four key components and building trust in AI (30:00)

The Centene team's work provides several critical implications and actionable strategies for cybersecurity defenders looking to enhance their incident response capabilities, particularly in hybrid cloud environments and with the integration of AI.

1. Prioritize Log Normalization and Standardization: The most fundamental takeaway is the imperative to adopt a universal schema for log data. Defenders should actively explore and implement frameworks like OCSF (or similar alternatives like ECS) to normalize logs from all sources—on-prem, cloud (AWS, Azure, GCP), SaaS applications, and custom solutions. This standardization, coupled with UTC conversion for all timestamps, is not merely a convenience but a critical enabler for accurate correlation, faster investigations, and reduced analyst fatigue. Inconsistent data is the primary enemy of efficient incident response.
2. Embrace Human-Centered AI Augmentation: Defenders should strategically integrate AI to augment, rather than replace, human analysts. Focus AI efforts on tasks where it excels: pattern recognition, clustering, data digestion, and initial contextualization (e.g., MITRE ATT&CK mapping). Critically, always maintain a human-in-the-loop model. Analysts must remain the ultimate decision-makers, validating AI outputs, especially given the risk of hallucinations. This preserves human judgment for complex scenarios and builds trust in AI tools.
3. Adhere to Evidentiary Standards for AI Outputs: Any AI solution deployed in incident response must be designed with forensic soundness in mind. Organizations should ensure their AI tools meet the principles of Darbert, Fry, and Durant—meaning outputs are testable, have known error rates, are peer-reviewed, and are generally accepted within the technical community. This is crucial for maintaining the defensibility of investigations, particularly in regulated industries or legal proceedings where AI-generated evidence may be scrutinized under Federal Evidentiary Rule 707.
4. Implement Robust Chain of Custody and Accountability: Defenders must ensure that AI tools never directly modify original evidence. Implement mechanisms to record the location and hash of original data, preserving its integrity. Furthermore, log all activities of AI tools within the SIEM. This logging provides crucial accountability, traceability, and visibility, enabling defenders to understand how AI arrived at its conclusions, troubleshoot issues (like hallucinations), and defend its use in reports. Without this, AI outputs are largely untrustworthy.
5. Proactive Threat Intelligence Integration: The demonstrated integration with OSINT sources like VirusTotal and OTX highlights the value of automating threat intelligence enrichment. Defenders should seek or build tools that automatically contextualize indicators of compromise (IOCs) within their timelines, providing immediate threat context and accelerating analysis.
6. Optimize AI Resource Consumption: Be mindful of AI token costs. Customizing prompts and scripts, as Dr. Coston noted, can significantly reduce unnecessary expenditure while improving the quality of AI output. This encourages thoughtful design of AI interactions to maximize efficiency.
7. Foster a "Living Timeline" Mindset: Adopt a dynamic approach to incident timelines. The ability to regenerate and update timelines with newly discovered logs or intelligence is invaluable. This "living timeline" concept ensures that investigations remain adaptable and comprehensive as new information emerges, avoiding the static nature of traditional, manually constructed timelines.

By implementing these defensive implications, organizations can transform their incident response from a reactive, fragmented process into a proactive, standardized, and AI-augmented capability, building greater trust and efficiency in their security operations.

Key Takeaways

• OCSF is a Game Changer for Log Normalization: Adopting the Open Cybersecurity Schema Framework (OCSF) is critical for standardizing disparate log sources across hybrid cloud environments, enabling consistent data processing and correlation, and future-proofing security operations.
• AI Augments, It Doesn't Replace: AI's primary role in incident response should be to augment human analysts by accelerating tasks like pattern recognition and clustering, allowing humans to focus on judgment and decision-making, especially given the current limitations of AI like hallucinations.
• Human-in-the-Loop is Non-Negotiable: Due to the potential for AI hallucinations and the critical nature of security decisions, a human-in-the-loop validation process is essential to ensure accuracy, build trust, and prevent investigations from going down false rabbit holes.
• Evidentiary Standards are Paramount: AI-assisted tools must adhere to legal and forensic standards such as Darbert, Fry, and Durant to ensure their outputs are testable, transparent, traceable, and defensible, particularly in regulated environments.
• Maintain Chain of Custody and Log AI Activity: Preserve the integrity of original evidence by ensuring AI never directly modifies it, and meticulously log all AI tool usage within the SIEM for accountability, traceability, and to explain AI behaviors.
• Compress the Triage Cycle with Contextualization: By automating log normalization, timestamp conversion to UTC, OSINT enrichment, and MITRE ATT&CK mapping, AI tools can significantly compress the incident triage cycle, allowing analysts to delve deeper into critical analysis faster.

About the Speaker(s)

Dr. Stephen Coston serves as a Lead Security Architect at Centene. With a background rooted in traditional forensics ("old school dead box guy"), Dr. Coston brings extensive experience in log timeline analysis and deep technical investigations. In his current role, he is instrumental in driving initiatives that integrate AI into security operations, focusing on augmenting SOC capabilities and providing robust, auditable technical solutions. His expertise lies in translating complex security problems into practical, defensible architectural designs, ensuring that AI implementations meet stringent evidentiary and operational standards.

William Rodriguez is the SOC Director at Centene, bringing years of experience across various tiers of security operations, from detection engineering to forensic specialization. As a director, his perspective is centered on identifying the critical needs and gaps within the SOC, constantly asking "what we need in the SOC to make it better." He focuses on strategic direction, ensuring that security initiatives, including the adoption of AI, directly address operational challenges and improve the consistency and quality of analyst work, ultimately enhancing the overall effectiveness of Centene's incident response capabilities.