Ransomware Kill Chain Investigator Agent
Automated ransomware triage with user/device/IOC enrichment and guided response.
- Category
- AI Apps and Agents
- Registry category
- Cybersecurity & ITThreat Detection & Response
- Vendor
- adaQuest (ADAQUEST, INC.)
- Location
- Bellevue, Washington 98007, United States of America
- Reviews
- Not rated (0 reviews on the listing)
- Listed on
- Microsoft Marketplace
- Pricing
- 1 plan listed
Each fact carries one Provenance score: the average of its Disclosure and Evidence scores, the same rule the page uses for the overall score. Click any score to see the math behind it.
Vendor Provenance
Who actually operates this agent.
Build Provenance
What the agent is built on.
Reach Provenance
How the agent is distributed and adopted.
Data Provenance
What the vendor discloses about data handling.
Compliance Provenance
What standards the vendor meets, and who verified them.
What the publisher says
Ransomware Kill Chain Investigator (RKCI) is a security-focused, read-only ransomware investigation agent that helps organizations analyze across Microsoft Defender and Microsoft Sentinel incidents with speed and confidence. It correlates evidence across users, devices, and indicators, maps activity to the ransomware kill chain, and produces an evidence-based investigation report with prioritized response actions.
The agent is designed for SOC analysts, incident responders, and security operations leaders. It supports both direct execution and guided chat for follow-up analysis.
Inputs (what data the agent consumes)
Show the rest of the publisher’s description (29 more lines)
The agent consumes Microsoft security signals such as Microsoft Defender incident data, Microsoft Entra user and sign-in context, Threat Intelligence data for hashes, IPs, and domains, optional Microsoft Intune device posture, and targeted KQL-based hunting results for ransomware behaviors.
If some signals are unavailable due to permissions, tenant configuration, unsupported dependencies, or retention limits, the agent runs in best-effort mode and reports data gaps and confidence impact instead of failing.
Tasks (what the agent performs)
Investigates ransomware-related incidents, correlates evidence into a kill chain view, enriches users, devices, and indicators, validates hashes, domains, and IPs, runs evidence-led hunts, generates prioritized containment, eradication, and recovery guidance, and supports guided analyst interaction through chat.
Outputs (what results the agent generates)
A consolidated ransomware investigation report including:
- executive summary
- kill chain correlation
- affected assets
- indicator findings
- prioritized response actions
- timeline highlights
- telemetry gap notes.
Estimated SCU consumption
Estimated consumption varies with incident complexity, entity volume, available telemetry, and required enrichment.
Expected consumption per run:
- Low-evidence or no-confirmation cases: around 0.2 to 0.5 SCUs
- Standard single-incident investigation: around 1 to 1.6 SCUs
- Deeper investigations with broader enrichment and hunts: around 1.2 to 1.8 SCUs
Rule of thumb:
- ~0.3 SCUs when no meaningful ransomware path is confirmed
- ~1.6 SCUs for a deeper end-to-end ransomware investigation-
Version 3.3.2
Change log
- Added proactive ransomware hunting in Microsoft Defender XDR, with or without an existing incident.
- Improved detection, entity enrichment, evidence correlation, and MITRE ATT&CK mapping.
- Added evidence-based confidence and coverage tracking to reduce unsupported conclusions.
- Optimized query results and incident processing to prevent context-length errors.
- Removed the direct Microsoft Sentinel workspace dependency and improved overall execution reliability.
Preview
4 imagesPlans and pricing
1 plan listed
Linked repositories
Unknown
Unknown means this listing does not publish a repository. It is not a statement that the code is closed.
Publisher resources
- Support (opens in a new tab)
- adaQuestRansomwareKillChainInvestigator (opens in a new tab)
- RKCI Web Page (opens in a new tab)
Sources
- Marketplace listingMicrosoft Marketplace (opens in a new tab)
- Legal linkPrivacy Policy (opens in a new tab)
- Legal linkLicense Terms (opens in a new tab)
- Company recordOutside company data, matched on adaquest.com
- Official registersam.gov (opens in a new tab)
Reading the score
Disclosure · how many sources corroborate it
Evidence · what kind of evidence backs it
The SettleTop steps above are possible but not automated yet, so today they sit open and a perfect 10 is out of reach. Open information like firmographics and reach has fewer steps to climb, so it sits a little higher for the same visible evidence.
Information shown here reflects the best available information at the time of assessment and may be incomplete, outdated, or subject to change. It should be independently verified before being relied upon for any decision. SettleTop is not liable for any errors, omissions, or decisions made in reliance on this information.
Have information about this agent?
Send it to us for consideration
Spot something missing, wrong, or out of date? Share what you know. Every note reaches our team. It does not change the passport by itself: we review it first.