Axonius Documentation
  1. Axonius AI
  2. The Axonius AI Companion

Investigating Notable Events

Use Axonius AI chat (the sidebar chat and the full-screen AI Chat page) to find notable events in the threat-intel feeds, check their indicators against your Axonius data, and get ready EDR hunting queries for your security team.

A notable event is a cyber event that Axonius Threat Intelligence reports from security news and that usually has no CVE at its center: for example, a supply-chain attack, a malware campaign, a data breach, or threat actor activity. Each notable event lists indicators of compromise (IOCs), such as IP addresses, domains, npm packages, file names, file hashes, and threat actor names. Many notable events also include hunting queries — ready queries you run in your EDR — for CrowdStrike Falcon, Microsoft Defender, and SentinelOne.

Required Permissions

To use Axonius AI chat, your role needs the AI Agents > View and interact permission.

Finding a Notable Event

  1. Open the sidebar chat or the AI Chat page.
  2. Ask a question such as:
    • "What new threats were reported this week?"
    • "Are we affected by the GhostAction campaign?"
    • "Is 203.0.113.10 in the threat intel?" (The agent searches IOC values, so an IP address, domain, or package name finds the notable event that lists that indicator.)
    • "Which threat-intel events mention CVE-2026-12345?"
  3. To read one notable event in full, ask about the event by its title.

[Screenshot: Axonius AI chat response listing a notable event with its category, IOC count, and hunting platforms]

For each notable event, the agent's response shows the event's category (for example, a supply-chain attack), its date and source, how many IOCs the event lists, and the EDR platforms the event has hunting queries for.

Checking Indicators in Axonius

The agent checks in Axonius only the indicators that Axonius data can answer:

  • CVEs named in the event: open Security Findings for each CVE.
  • npm packages: Installed Software by package name, where an adapter inventories npm packages (for example, an EDR software inventory or an SBOM).
  • Threat actor names: the CVEs the actor is known to exploit, from the actor's threat profile, then open Security Findings for those CVEs.
  • GitHub repositories and accounts: the GitHub adapter data, when the GitHub adapter is connected.
  • IP addresses, domains, and URLs: only whether one of your own assets holds the address or name. Connections to an address are a question for your EDR, firewall, or DNS logs.
  • Email addresses: whether the address belongs to one of your own user accounts.
  • Malware names and file hashes: only where an EDR adapter reports them per device.

The agent's response lists the counts from these checks and the queries behind them.

Getting EDR Hunting Queries

For every indicator Axonius data cannot answer — for example, file names, file paths, registry keys, GitHub workflow files, and wallet addresses — the agent hands the check to your EDR or SIEM.

  1. Ask "Give me the hunting queries for this event."
  2. Copy the query from the code block in the agent's response and run it in your EDR.

[Screenshot: Axonius AI chat response with a Microsoft Defender hunting query in a code block]

The agent gives only the hunting queries for the EDR platforms connected in Axonius as adapters, verbatim, with each query's description. The agent also states how many devices no EDR adapter reports, because the hunt cannot cover those devices. When no EDR adapter is connected, the agent gives the queries for every platform in the event.

Limitations

  • The agent never runs, changes, or writes a hunting query. Every query is the text Axonius Threat Intelligence published.
  • Zero results from a hunting query means the query did not find the indicator, not that your environment is clean.
  • A CrowdStrike Falcon query for a file name searches process events only. A script, package, or configuration file that never runs as a process does not appear in the results.
  • A notable event carries no severity. The agent prioritizes by what the Axonius checks find: open findings, an affected package, or one of your own assets named as an IOC.
  • A notable event lists the threat actors and CVEs that the report names, which are not necessarily linked. To learn which groups exploit a CVE, ask "Which threat groups exploit CVE-X?" The agent names groups from the hot-CVE and threat-profile records only, never from notable events.
  • The agent does not repeat the names of private persons (for example, maintainers, employees, or victims) from an event summary.
  • An event keeps at most 60 IOCs and 90 hunting queries (30 per EDR platform).

Updated 4 days ago

Did this page help you?