Pivot Analyst Workbench: cross-source hunting without SQL
Tier 2 analysts lose hours context-switching between EDR, Entra, PSA, and spreadsheet exports. The Pivot Analyst Workbench (public name in product wiki) is Dual-Strike XISEM’s structured hunting layer: start from any evidence object and follow platform-defined pivots without writing queries.
Route: Asset modal → Pivot · Threat Center → Investigate · Support wiki → Pivot analyst workbench
Entry points
• Browser session — User, device, related detections, domain prevalence
• Entra sign-in — Device, location class, mailbox rules, COBRA hits
• Detection — All contributing signals, affected assets, PSA ticket
• File hash — Other assets with hash, TI feed match, process tree (EDR)
• CVE — Affected assets, patch status, network exposure
Workbench vs. Investigations
• Workbench — exploratory, ephemeral trail while analyst thinks
• Investigations — persistent case with notes and assignee
Promote workbench trail to Investigation when you know you have a case.
MSP hunting playbooks (public)
Shadow AI hunt
1. Browsing Insights → filter AI category → open session
2. Pivot user → all AI domains 30d
3. Pivot detections → COBRA shadow AI rules
4. Create Investigation + PSA ticket
BEC hunt
1. Email integration → suspicious rule change
2. Pivot identity → sign-ins + mailbox
3. Pivot browsing → OAuth grants
4. Escalate Critical if dual control failed
Training new analysts
Workbench teaches correlation paths native to Dual-Strike XISEM — faster ramp than teaching five vendor consoles. Pair with COBRA² guide and Asset modal post for onboarding curriculum.
Limits (honest)
• Pivots require Gateway coverage — no Entra pivots without GDAP
• Historical depth follows retention policy — long hunts may need exported reports
• Workbench does not replace EDR process graph for deep malware analysis — pivot into vendor console when containment needed
Related: Investigations workflow · Browsing Insights · Threat intelligence feeds
Workbench pivot catalog expands per release — in-console menu is authoritative.