Kindling
FindingsDashboardQueue
InvestigateCasesIntegrationAnomaliesIntelBrain
AdminCases AdminDocsRulesSettings
...
Loading...

Analysis Signal Flow

Every scoring, ranking, and analysis signal in Kindling — where it comes from, what consumes it, and whether Stick sees it.

20
Total Signals
11
Fully Connected
15
In Stick Context
2
Fixed in Audit
Legend: In Stick context Stick tool Shown in UI

Signal Registry

20 signals — expand each for producer, consumers, and cache details

Priority Score Composition

Base score of 50, adjusted by these factors before Stick is invoked

FactorRangeSource Signal
Finding Priority (P1/P2/P3)±20 to +30Finding metadata
Detection FP Rate-25 to +20Detection FP Rates
Workflow Sentiment-20 to +15Workflow Sentiment
Neglect Pattern-15 to 0Neglect Pattern
MSP Cohort TP Rate-15 to +20MSP Cohort
Authorization (org/MSP/global)-30 to 0Authorized Patterns
Evidence Remediation-15 to 0Evidence Remediation
Related Findings-5 to +20Finding analysis
Filter Recommendation Match-20 to 0Filter Recommendations
Detection Rules-20 to +10Detection Rules
Evidence Extremity (IOC keywords)0 to +15Evidence analysis

Stick Context Builder

20 sections injected into every Stick review + 15 investigation tools on-demand

1.
Finding Identity + Evidence← evidence_summary
2.
Authorization Context← Authorized Patterns
3.
Scoring Result + Constraints← Priority Score
4.
Detection Condition (bludac)← Detection catalog
5.
Raw Evidence← BigQuery / match records
6.
Pre-enriched Threat Intel← Shodan / WHOIS / DNS
7.
Scoring Factors← Priority Score factors
8.
Resolution History← resolution_stats
9.
Workflow Sentiment← Workflow Sentiment
10.
Related Findings← Finding analysis
11.
Neglect Pattern← Neglect Pattern
12.
MSP Cohort← MSP Cohort
13.
Org Risk Profile← Org Risk Score
14.
CRM / Business Context← CRM Profiles
15.
Filter Recommendations← Filter Recommendations
16.
Stick Decision History← LLM decisions store
17.
Detection Intelligence← Detection Intelligence
18.
Evidence Remediation← Evidence Remediation
19.
Confidence Breakdown← Pipeline Confidence
20.
Analyst Context← Manual entries

Audit Findings

Gaps identified and resolved during signal flow audit

Fixed: Org Anomalies tool added to Stick

get_org_anomalies was implemented as an MCP tool but was not declared in Stick's investigation tool list. Stick can now query per-org anomalies (volume spikes, new detection types, behavioral shifts) during finding analysis.

Fixed: Attack Chains tool created for Stick

Precomputed entity-level attack chains were only available inside the security monitor endpoint. A new get_attack_chains MCP tool was created so Stick can check if the current finding's entity is part of a broader multi-detection attack pattern.

Acknowledged: Trend Analysis is Chat-only

analyze_trends is a macro-level view (24h+) used by the Chat interface. Per-org anomalies (which IS available to Stick) covers the relevant per-finding use case.

Acknowledged: Detection Rules are scoring-only

Detection-level rules (is_benign, rules_multiplier) feed into scoring but aren't exposed to Stick or the frontend. Their effects are visible through the risk_multiplier in detection stats and the scoring factors.

Pipeline Architecture

Three-phase data flow from ingestion to user-facing output

// Phase 1: Precompute (scheduled every 5-30 min)
BigQuery → Detection FP Rates, Org Risk, Authorized Patterns, Attack Chains
BigQuery → Anomaly Engine (top 50 risk orgs, MSP cohort-aware)
HubSpot → CRM Profiles | Column → Log Source Profiles
→ All cached to GCS (k6g_state bucket)
// Phase 2: Per-finding analysis (continuous)
Finding → evaluate_finding() → Priority Score + Confidence + Factors
→ Workflow Sentiment, Neglect, MSP Cohort, Filter Recs, Authorization
→ Gating check (min_score, always-review keywords)
→ If passes: Stick LLM review (20 context sections + 15 tools)
→ StoredFindingAnalysis cached to GCS + Redis
// Phase 3: Consumption
Frontend: Triage queue, Dashboard, Investigate pages, Cases
Slack: Channel-routed alerts (severity/org/type routing)
Cases: Auto-creation, evidence bundles, escalation