Context Memory
Overview
Context Memory in Dropzone AI captures and distills institutional knowledge—details that aren’t directly observable in security telemetry, but that experienced analysts and documented processes consider essential to investigations.
It augments the AI SOC Analyst’s understanding of alert entities with learned organizational facts, reducing manual research and accelerating decision-making.
This guide outlines recommended practices for structuring, populating, and maintaining Context Memory, as well as its operational behavior and limitations.
Purpose and Role in Investigations
Context Memory enables Dropzone’s AI SOC Analyst to incorporate organization-specific knowledge during investigations. It supports:
Answers to broad investigative questions such as: “Is there anything notable in our organization’s background about these IPs or domains?”
Entity-specific enrichment as investigations progress
The AI SOC Analyst is designed to operate like an experienced human analyst—correlating alerts, querying tools, and drawing conclusions. Context Memory enhances this capability by tailoring analysis to your environment.
Context Memory should be used to capture facts about entities, such as:
What something is
Who owns it
How it is typically used
If you find yourself encoding workflows, decision trees, or if/then logic, you are likely designing a Custom Strategy, not Context Memory.
Best Practices
Build Context Memory Like a Senior Analyst Guiding a Junior
Context Memory becomes more valuable over time, much like a junior analyst improving through experience and mentorship. Knowledge is added in three primary ways:
Learning from Investigations
When an analyst:
Confirms an alert as Malicious
Changes a verdict to Malicious or Benign
…the outcome and supporting notes are synthesized into Context Memory.
When providing feedback, specificity matters:
✅ “Application Foo is allowed in our environment”
✅ “Emily Eaton is approved to run
certutil.exe”❌ “This is allowed”
Specific facts teach the system far more than vague approvals.
Manual Notes and Guidance
Teams can manually add facts to Context Memory, similar to how senior analysts write notes or runbooks.
Examples:
“Device hostname
honeycombis our honeypot for external attackers”“This AWS account is used exclusively for development testing”
Manual entries are ideal for clarifying known exceptions or environmental nuances.
Automated Ingestion
Institutional knowledge can be backfilled using exports from systems such as:
Confluence
Jira
ServiceNow
These sources can be programmatically ingested into Dropzone.
Focus on high-value, low-visibility information—facts that analysts rely on but do not appear in telemetry or alerts.
As with new-hire training, early investment in Context Memory during onboarding provides a strong foundation for long-term effectiveness.
Structure Context Memory by Operational Relevance
To improve precision and recall during investigations, organize Context Memory into clear operational domains. Recommended categories include:
External Network Company-owned IPs, domains, approved VPNs, office locations
Internal Infrastructure Guest or test systems, development cloud accounts
IT Administration Break-glass admin roles, remote access tooling
Security Testing Red/blue team IP ranges, known scanners, simulated hosts
Cloud Environments Automation roles, provisioning systems
Third Parties Trusted domains, federated identities, partner systems
Custom Applications Internal software, tools prone to false positives
Travel and Location Context Corporate travel events, remote work locations
Clear structure enables better context linking and more confident triage decisions.
Keep Memory Fresh and Focused
Continuously learn Incorporate new alerts, analyst decisions, and investigation outcomes over time.
Provide high-quality feedback Specific investigation feedback gives the AI better training signals. Feedback events can be exported in real time via Response Automations.
Perform periodic audits Remove stale entries, consolidate duplicates, and refine wording to maintain clarity.
Regular maintenance prevents confusion during investigations and improves analyst confidence in AI outputs.
Operational Behavior
Context Memory serves two primary functions during investigations:
Proactive Query Support
When analyzing an alert, the AI checks whether known facts in Context Memory relate to involved entities such as IPs, domains, or instance IDs.
Contextual Skill Chaining
As investigations deepen, the AI uses Context Memory to answer follow-on questions, such as:
“Is this domain internal?”
“Is this system expected to generate this activity?”
This layered approach ensures Context Memory adds value throughout the entire investigation lifecycle.
Limitations and Considerations
Coverage Is Only as Good as the Input
If Context Memory is incomplete or stale, the AI may reference gaps or outdated facts. While this does not prevent investigations from completing, it can reduce confidence or clarity.
Facts, Not Analysis
Context Memory is a source of evidence, not decision logic.
Example:
A VPN provider may be generally allowed
A specific use of that VPN may still be suspicious
When you need to encode logic or influence conclusions broadly, use Custom Strategies.
Semantic, Not Exact Matching
Context Memory relies on semantic similarity, not exact string matches. This means the AI:
Can retrieve relevant facts even when terminology differs
May apply higher-order concepts across contexts (e.g., “Engineering team is based in North America” influencing analysis of an IT admin login from Paris)
May occasionally surface irrelevant facts that lead to dead ends
Cannot Answer All Questions
Context Memory does not replace:
Threat intelligence
Direct access to security systems (EDR, SIEM, CSP)
Complex behavioral correlation
It complements these capabilities rather than substituting for them.
Conclusion
Context Memory empowers Dropzone’s AI SOC Analyst to bring institutional knowledge into every investigation.
By curating relevant facts, structuring them for fast recall, and continuously refining the memory corpus, teams can:
Accelerate triage
Reduce manual research
Improve investigation quality
When properly maintained, Context Memory becomes an extension of your most seasoned analyst—available in every investigation.
Last updated
Was this helpful?