---
title: "Investigate threats using Generative AI"
slug: "investigate-threats-using-generative-ai"
tags: ["EDR with Forensics (EDRF)", "Endpoint Security"]
updated: 2026-09-18T11:47:27Z
published: 2026-09-18T11:47:27Z
canonical: "docs.trellix.com/investigate-threats-using-generative-ai"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigate threats using Generative AI

Trellix Wise provides Generative Artificial Intelligence (AI) investigation capabilities to analyze threats through existing Trellix EDR workflows. You can run natural language queries to investigate threats, summarize threat data, and view breach information. You can visualize relationships between entities through a knowledge graph. Trellix Wise recommends remediation actions you can perform in the same window.

You can access Trellix Wise capabilities through the **Monitoring** page, **Device Search**, **Historical Search**, and **Real Time Search** workflows. Supported search workflows include natural language search in **Historical Search** and **Real Time Search** . Trellix Wise supports investigations in 11 languages.

**Investigate historical data using Case Graph Visualizer**: Download the investigation historical case data from the EDRF UI and view it offline using the Case Graph Visualizer.

For more information, see the Trellix Knowledge Base article - How to use Case Graph Visualizer to view Trellix EDR investigation historical data - [KB000015761](https://support.trellix.com/s/article/000015761).

> [!WARNING]
> Important
> 
> Trellix retires the previous Investigation feature on September 14, 2026. To continue investigating threats, use Trellix Wise capabilities in supported Trellix EDR workflows. Export or archive investigation data from the previous Investigation feature before September 14, 2026. After September 14, 2026, contact **Trellix Support** to retrieve historical investigation records.

### Before you begin

The Trellix Wise add-on capability is enabled for your tenant at no additional cost. You do not need additional configuration to use Trellix Wise capabilities.

To enable Trellix Wise on your tenant:

1. Navigate to **Menu** → **Configuration** → **Settings**.
2. Select **Wise Settings**.
3. Turn on the **Enable Trellix Wise** toggle.

This enables Trellix Wise capabilities in **Monitoring**, **Device Search**, **Historical Search**, and **Real Time Search**.

### Investigate threats using Trellix Wise

Follow a standardized investigative workflow to analyze and resolve threats using Trellix Wise.

- [Triage and analyze threats](/v1/docs/investigate-threats-using-generative-ai#triage-and-analyze-threats)
- [Hunt across endpoints](/v1/docs/investigate-threats-using-generative-ai#hunt-across-endpoints)
- [Analyze behavior and root cause](/v1/docs/investigate-threats-using-generative-ai#analyze-behavior-and-root-cause)
- [Document incidents collaboratively](/v1/docs/investigate-threats-using-generative-ai#document-incidents-collaboratively)
- [Perform remediation actions](/v1/docs/investigate-threats-using-generative-ai#perform-remediation-actions)

#### Triage and analyze threats

Use Trellix Wise to analyze threats and provide context for your incident response team.

1. Navigate to the **Monitoring** dashboard and triage the threats.
2. Select a specific threat to analyze.
3. Select **Ask Wise**.
4. Select the **Interactive** or **Dossier** mode.

Trellix Wise provides a detailed natural language analysis of the threat.
5. Click the Copy button in Ask Wise panel to copy the analysis to a Jira or ServiceNow ticket.
6. Click the **Draft an Email** button in the Trellix Wise panel to directly add the analysis to an email.

This initiates the containment workflow and ensures the incident response team has immediate context.

#### Hunt across endpoints

When you identify a new threat, search across endpoints using natural language in Historical Search and Real Time Search.

**Threat hunting in Historical Search**

Use Historical Search to query past endpoint telemetry using natural language.

1. Select **Menu** > **Historical Search**.
2. Select **Search with Wise**.
3. Enter your threat hunting query in natural language into the search field.
4. Select a time period for the search.
5. Select the search icon to execute the query across stored endpoint data.
6. Filter or group grid columns, or select **Export All** to download up to 100,000 results.

**Threat hunting in Real Time Search**

Use **Real Time Search** to query active processes and current events on live managed endpoints.

1. Select **Menu** > **Real Time Search**.
2. Select **Search with Wise**.
3. Select a time period, then select **Apply**.
4. Enter your query in natural language into the search field.
5. Select the search icon to query live endpoints directly.
6. Review returned results, select **Save Search** to store the expression, or select **Export All** to export data.

#### Analyze behavior and root cause

When you investigate a potential credential theft threat, identify unusual memory access using Device Search. Trellix Wise reconstructs the attack path to visualize the initial execution and lateral movement.

1. Navigate to **Device Search** to view device events.
2. Select the specific events.
3. Select **Ask Wise**.
4. Select the **Interactive** or **Dossier** mode.

Trellix Wise provides a natural language analysis of the threat.
5. View the Knowledge Graph to analyze the attack path.
6. Share the Wise-generated details through email or an incident management tool such as Jira or ServiceNow.

This ensures that your incident response team shares an accurate understanding of the root cause.

#### Document incidents collaboratively

Use Trellix Wise to generate and share standardized summaries of event timelines for complex incidents. This provides context for stakeholders and streamlines the handover process between shifts.

1. Select **Ask Wise** in **Monitoring** or **Device Search**.
2. Select the **Interactive** or **Dossier** mode.

Trellix Wise provides a natural language analysis of the threat.
3. Click the Copy button in **Ask Wise** panel to copy the analysis to a Jira or ServiceNow ticket.

#### Perform remediation actions

When an investigation confirms a threat, use **Ask Wise** to expedite recovery.

1. After you analyze the incident in **Monitoring** or **Device Search**., select **Ask Wise**.
2. Select the **Interactive** or **Dossier** mode.
3. Select the **Suggest some Recommended Actions** interactive button.
4. Perform the recommended actions directly from the **Ask Wise** window.