• TRIAGE
  • CONTEXT
  • ANALYSIS
  • DECISION

How to investigate security alerts with your AI

Connect Lacework to your agent to pull deep context directly into your chat. You stop jumping between tabs to figure out what a specific alert actually means.

Ask AI about this page

Short answer

How can I use AI to investigate Lacework alerts?

Your agent uses Lacework tools to fetch specific alert details and run queries for behavioral metadata. This gives you the full context of a security event without manual searching. You get a clear picture of the threat and the affected assets.

Investigation outcomes.

Where your investigation leads.

The AI handles the data gathering so you can focus on the decision.

TRIAGE

Filtered alert lists

The agent uses search tools to find specific security events. You get a clean list of what matters right now.

CONTEXT

Deep alert details

Your agent pulls the specific metadata tied to a single alert. You see exactly what triggered the signal.

ANALYSIS

Behavioral data

The agent runs queries to pull surrounding activity. You see the patterns that explain the alert's severity.

DECISION

Human review

The AI presents the findings, but you decide if the alert is a true positive. You make the final call on remediation.

The workflow

What your AI does when the alert arrives.

The agent acts as your investigative researcher, pulling data from Lacework on demand.

  1. Find the signal

    The agent scans your Lacework environment to locate specific security events or patterns.

    search_alerts

  2. Inspect the alert

    Once an alert is identified, the agent pulls the specific payload and metadata for that event.

    get_alert

  3. Gather context

    The agent runs custom queries to pull behavioral data and environmental context related to the alert.

    execute_query

  4. Summarize findings

    The agent combines the alert details and query results into a single explanation for you.

    get_alert

Try it

Copy these to start.

Use these prompts to kick off an investigation.

Starting points

These are starting points. Swap out the alert IDs or resource names with your actual Lacework data.

Lacework Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_xT38bIhhFhzvvpfxyO01Dv9Iop7sXt66wD8neHzv/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Lacework capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "lacework-cloud-security-cnapp-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_xT38bIhhFhzvvpfxyO01Dv9Iop7sXt66wD8neHzv/mcp"
    }
  }
}
Copy into chat04

  • Search for all high severity alerts in Lacework from the last 24 hours.

  • Get the details for alert ID 98765 and tell me what triggered it.

  • Run a query to find all anomalous network traffic in my production environment.

  • Look at the metadata for the most recent alert and summarize the affected resource.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Lacework once, then ask.

Enter your Lacework credentials once. The connection is encrypted and stays secure, letting your agent pull data whenever you ask.

Connect Lacework to your AI

FAQ

How this task behaves.

  • 01

    Can the AI fix the security issue for me?

    No. The AI can only read alert data and run queries. You must manually perform any remediation in Lacework.

  • 02

    Can the AI delete alerts?

    No. The tools only allow for searching, getting, and querying data. The AI cannot modify or delete your Lacework records.

  • 03

    Does the AI see all my cloud data?

    The AI only sees the data it can access through the specific Lacework tools provided in the manifest.

  • 04

    How does the AI get behavioral context?

    It uses the query tool to pull specific environmental and behavioral data points from your Lacework instance.

  • 05

    Can I use this with any AI client?

    Yes, as long as your client is MCP-compatible, like Claude, Cursor, or Windsurf.

  • More questions about Lacework? See everything the Lacework Connector can do

Connect Lacework to Claude, Cursor, ChatGPT & more