Overview
Kindling is Blumira's LLM-powered investigation layer, built directly on your existing Blumira data. It is a security tool designed to condense and contextualize your organization's entire security landscape, moving beyond isolated alerts. Kindling transforms raw, often overwhelming, volumes of event data into actionable intelligence by centralizing, correlating, and enriching disparate log data.
You can use Kindling to get a comprehensive, clear view of your security posture and ongoing incidents. This allows you to be more proactive and strategic, because it significantly reduces the time required for detection and response while minimizing the overall impact of security incidents.
Additionally, your app interactions make Kindling smarter and more accurate over time. Every triage decision, resolution type, and workflow answer feeds back into the scoring system. The more that Kindling accumulates your decisions about a detection type, the better that it predicts whether new instances are real threats or noise.
Note: You cannot assign findings in Kindling and must assign them to a responder in the main Blumira interface. You can choose a resolution for the finding in Kindling and it will sync to the finding in Blumira.
How findings and cases work together
Findings and cases represent two distinct and complementary approaches to security monitoring within the Blumira platform.
Findings: The foundational alert
Whereas cases provide a holistic view, findings are Blumira’s foundational security detections. They entail the following:
- Singular and Discrete Events: A finding alerts you to a singular, discrete action or event. These are isolated occurrences that meet specific detection criteria and indicate activity that might be malicious or anomalous.
- Moment-Specific Data: A finding provides data that is specific to that moment's activity. It is an immutable record of a specific log entry, system behavior, or policy violation at a precise time. Examples of a finding include a failed login attempt, a new executable launching, or a sensitive file that was accessed.
- Building Blocks: Findings are the building blocks from which cases are constructed. Although a single finding might be low-risk, a coordinated series of related findings, when combined through Blumira’s analytics, becomes a high-fidelity case.
Kindling enhances findings by adding analysis from Stick (Kindling's built-in AI analyst) to offer more supporting details and organizational context, such as a confidence rating, the reason why it suggests taking or not taking action, and the timing of that action. Furthermore, a knowledge graph, which is a visualization of entities, helps you better understand relationships that are otherwise be in raw log data.
Kindling: The contextualized attack narrative
Kindling Cases are a comprehensive view of a potential security incident. They act as an investigative backbone, moving beyond individual findings to construct a full narrative of an attack chain so that you can understand the scope and severity of an issue. This entails the following:
- Correlation and Context: Kindling correlates a series of related activities and known attack behaviors that occur over a period of time. It pieces together the sequence of events, instead of breaking it up by individual actions.
- Attack Chain Visualization and Timeline: After correlating a sequence of events, Kindling displays a comprehensive view of the attack chain. This visualization helps you quickly grasp how an attacker progressed, from initial access to execution or lateral movement.
- Impacted Entities and Next Steps: Each case provides specific intelligence about the impacted entities (e.g., users, hosts, applications) and displays immediate, actionable guidance for your investigation and remediation. It prioritizes the most significant and complex threats that require your immediate attention.
This table summarizes the key difference between findings and cases:
| Feature | Case | Findings |
|---|---|---|
| Scope | Comprehensive, multi-stage attack narrative | Singular, discrete action or event |
| Function | Threat correlation, incident visualization | Foundational alert, data record |
| Data Provided | Correlated attack behaviors, impacted entities, remediation steps | Data specific to that moment's activity |
| Complexity | High-fidelity and represents a potential attack chain based on complex assessment of a broad dataset, previous history of answers, and actions taken in Blumira over time | Low to medium-fidelity and represents an observation |
Key concepts
Kindling
The LLM-powered investigation tool found at torch.blumira.com and built from your Blumira data.
Finding
A security alert from Blumira's detection pipeline. Every finding has a match, which is the raw evidence that triggered it.
Workflow sentiment
The assessed intention of a finding resolution based on workflow responses.
Priority score
A 0–100 score synthesizing all available signals, including history, organizational context, sentiment, and related findings. A case’s score starts at 50 (neutral) and increases or decreases based on these signals.
Stick
An LLM-powered analyst (Gemini Flash) that reviews high-scoring findings, self-investigates using tools, and produces structured threat determinations.
Case
A group of related findings tied to a potential incident. Kindling auto-discovers and merges related findings based on shared evidence.
End-to-end flow
Blumira detects → Generates a finding → Priority score calculation → Stick reviews (score ≥ 30) → Threat determined → Case created → You triage and resolve
Triaging findings in Kindling
When you go through the triage process of reviewing a finding and resolving it, Kindling begins building on the finding. Every decision you make in a finding immediately starts improving future scoring.
The Findings Detail page in Kindling contains the following:
| Field | What it is |
|---|---|
| Name | The detection rule (e.g., "SentinelOne Unmitigated Threat", "Suspicious PowerShell Execution") that triggered a finding |
| Priority Score | Kindling’s mechanism for identifying what to focus on |
| Priority | Severity level, which is one of Critical, High, Medium, or Low |
| Stick Analysis | A plain-language assessment of the activity in the context of the organization, with clear reasoning, key indicators, recommended action, and supporting evidence |
| Type | The type of finding, which is one of Threat (most serious), Alert, Suspect, Risk, or Operational (least serious) |
| Category | MITRE ATT&CK® tactic (e.g., Credential Access, Lateral Movement) or custom category |
| Status | Open, In Progress, or Resolved |
| Entity Graph | A visualization of the entities listed in the finding, showing their relationship to other entities and findings |
| Evidence | The raw evidence for investigation, including IPs, usernames, hostnames, commands, file hashes, and process trees. The structure of matched evidence varies according to the finding’s detection rule. Viewing options include Summary, Table, and Raw. |
Reviewing and resolving a finding
Blumira findings appear in Kindling, where you can see additional context, Stick analyses, and visualizations.
To review and close a finding in Kindling, do the following:
- Navigate to Kindling Findings by doing one of the following:
- On a finding's detail page in Blumira, click View Finding in Kindling.
- Log in to Kindling at torch.blumira.com and navigate to Findings.
- On a finding's detail page in Blumira, click View Finding in Kindling.
- Click a finding to open its details page.
- Review the Stick Analysis, including its determination (Threat / Benign / Investigate), confidence level, plain-language reasoning, and the key indicators that drove the decision.
- If there is a linked case, click View case at the top of the finding detail page to view and investigate it.
- To close the finding, click Open at the top of the page, then select the resolution you want to apply to the finding.
- In the Resolution notes box, type a note that describes why you selected the resolution.
- Click Save.
When Stick triggers a case from findings
Stick triggers cases upon Threat determination in a finding, and Kindling then either creates a new case or merges the triggering finding into an existing case that is still in Open status. Kindling does not automatically create cases for Benign and Investigate determinations, nor does it merge findings with closed cases. However, on a finding’s detail page, you can manually create a case or add it to an existing case.
Workflow sentiment
Kindling reads the workflow answers you provide when resolving a finding and analyzes them to understand the selected resolution’s actual intention or sentiment. Kindling then uses the sentiment to adjust the finding’s priority score accordingly.
Example: An administrator running PuTTY triggers a "suspicious tool" finding that is closed with resolution of “Valid” (i.e., it was real activity), but the workflow indicates that the activity is authorized (i.e., it is not a threat). Kindling's workflow sentiment analysis disambiguates this automatically and reduces the priority of the finding.
In Blumira, finding resolutions have the following meanings:
| Resolution | What it means |
|---|---|
| Valid | The detection was correct, and real activity occurred. The activity could be a real threat or authorized activity. Finding workflow sentiment analysis determines which. |
| False positive | The detection was incorrect, and there was no real activity of concern. |
| No action needed | This was real activity, but there is no response required. |
| Risk accepted | This is real activity, and you acknowledge and accept the risk associated with that activity. |
The following are the workflow sentiment meanings and score effects that Kindling interprets from findings:
| Sentiment | What it means | Score effect |
|---|---|---|
| Authorized activity | Real but expected activity that is approved occurred (such as from an IT administrator, approved tool, or normal process). | Heavy reduction (−25) |
| Confirmed threat | Real malicious activity, such as a compromise, attack, or exfiltration occurred. | Priority boost |
| Remediated | There is a real threat that is already contained or handled. | Slight boost (validates the finding) |
| Pen test | An authorized security testing or red team exercise occurred. | Heavy reduction |
| Policy violation | A rule was broken but not maliciously (such as when using unapproved software or a personal device) | Moderate reduction |
Priority score
Every finding gets a priority score between 0 and 100, synthesizing all available signals into a single number. Findings start at a neutral score of 50, and various pre-defined factors increase or decrease the score from there. Priority score is the primary mechanism for deciding which findings to triage first, and the score influences what Stick automatically reviews.
Priority score ranges are defined as follows:
| Score | Meaning |
|---|---|
| 81–100 | Urgent |
| 66–80 | High priority |
| 46–65 | Medium |
| 26–45 | Low priority |
| 0–25 | Likely benign |
Stick analysis
Stick is Kindling's LLM-powered security analyst, which runs on Gemini Flash. For each finding, Stick receives the full context, including finding details and evidence, resolution history and false-positive rates, organization risk profile, filter recommendations, detection statistics, and per-organization anomalies. Stick self-investigates with access to various tools, and it can make up to five tool calls per review, such as enriching IPs via Shodan, checking related findings, looking up organization risk profiles, and more.
Every five minutes, Stick reviews findings that meet the following criteria:
- They have a priority score at or above 30.
- They are findings, such as “Impossible Travel,” that Stick always reviews regardless of priority score.
- They contain pre-defined keywords like "ransomware," "C2," or "honeypot," which also always require Stick review.
Stick's structured output
After Stick analyzes a finding, it provides a summary that includes the following:
| Field | Values | What it means |
|---|---|---|
| Determination | Threat / Benign / Investigate | Stick's overall assessment of the finding |
| Severity | Critical / High / Medium / Low / Info | How serious Stick thinks the threat is |
| Response urgency | Immediate / Urgent / Standard / Routine / Informational | How quickly action is needed |
| Confidence | 0.0 – 1.0 | How certain Stick is in its determination |
| Reasoning | Natural language | Plain-language explanation of what Stick found and why |
| Recommended action | Natural language | Specific next step that Stick recommends |
| Key indicators | List | The specific evidence points that drove Stick's decision |
Anomaly detection
Kindling runs two layers of anomaly detection to catch and create cases for unusual activity that might not surface through normal priority scoring alone.
| Detector | What it catches | How |
|---|---|---|
| Attack chain | When three or more stages aligning with MITRE ATT&CK® techniques are present | Every finding is tagged with ATT&CK techniques and known patterns emerge. Kindling deprioritizes authorized or benign activity |
| Behavioral shift | A change in evidence patterns for a known detection | Over half of the evidence field values (IPs, users, hosts) are new and were not seen in the baseline period. |
| New detection | A detection type your organization has never seen before | The detection is the first occurrence in your organization's entire history. |
| Volume spike | A sudden increase in finding count |
Z-score vs. a 14-day daily baseline where the standard deviation determines risk as follows:
|
About attack chain detection
Kindling identifies the following attack chain patterns across your findings:
| Pattern | Stages of attack by technique |
|---|---|
| Classic intrusion | Reconnaissance → Initial Access → Execution → Persistence |
| Credential theft | Initial Access → Credential Access → Lateral Movement |
| Data exfiltration | Collection → Command & Control → Exfiltration |
| Ransomware | Execution → Defense Evasion → Impact |
| Privilege escalation | Credential Access → Privilege Escalation → Persistence |
Responding to Kindling Cases
A case groups one or more related findings into a single unit of work when Stick identifies a threat. When a case is created, Kindling goes beyond the triggering findings to automatically discover and merge related findings by checking for shared IPs, hosts, and users across other open, unresolved findings in the same organization.
How a finding becomes a case
Finding scored → Priority score is 30 or higher → Stick reviews → Stick determines it is a threat → Kindling creates a new case or merges into existing case
Each case includes the following elements:
| Field | What it is |
|---|---|
| Severity | Stick's holistic assessment, represented as critical, high, medium, or low; independent from finding priority |
| Status | The state of investigation, from new to investigating to closed, or expired if left open for longer than 7 days |
| Case Analysis | A holistic LLM assessment of all related findings, with a confidence rating, the full attack narrative in plain language, action recommendations, and a list of deduplicated entities |
| Attack Timeline | A chronological listing of the findings that are grouped into the case, including auto-discovered related findings with resolution context and signals pulled from finding workflows |
| Attack Chain Graph | Aggregated users, hosts, and IPs across all findings, with investigation queries and the attack chain |
| Customer summary | A generated customer-facing narrative explaining what happened in plain language |
| Activity timeline | A chronological log of all actions, including acknowledgments, analyst notes, escalations, and status changes |
| Related cases | Other cases with overlapping entities, scoped to the same organization, never cross-customer |
Case status lifecycle
The table below outlines the meaning of each case status and its potential transitions.
| Status | Meaning | Transitions |
|---|---|---|
| New | Initial status when a case is created | Can move to any other status. No other status moves back to New. |
| Investigating | After clicking Acknowledge in Case Actions, the Investigating status signals to other users that someone is actively working the case |
A case can only move forward to Closed from Investigating. A case can be re-opened from Expired or Closed to return to the Investigating status. There are no alerts when re-opening a case and entering the Investigating status again. |
| Expired | A case automatically expires after 7 days if it remains in New or Investigating status for 7 days. This status cannot be manually set. | The expiration timer starts on the day the new case was opened or the day it moved to Investigating. Closed cases are exempt from expiration. |
| Closed | Investigation is complete. Requires selecting a resolution; an optional note can be added. Includes an option to close all related findings in Blumira. | Closed status is reachable from New or Investigating. Closed cases do not expire. |
Viewing and responding to a case
To view and respond to a case, do the following:
- Log in to Kindling at torch.blumira.com.
- Navigate to Cases.
- Click a case to open its detail page.
Note: Cases appear in order of severity and recency. Cases do not have assigned owners, and any user with access can investigate and act on a case. The Case Timeline section at the bottom of each case displays the username of the person who changed the status or added a resolution. - Click Acknowledge to signal that you are working on the case and update the case status to Investigating.
- Review the Case Summary, all linked findings as detailed in the Attack Timeline, and a visualization of their relationships in the Attack Chain Graph.
Note: Kindling merges findings based on shared IPs, hosts, or users, not just detection type. - In Investigation Queries, click Run next to each query to see the logs narrowed to the given filter.
- (Optional) If you need to change the case's priority, do the following:
- At the top of the page, click Change Priority.
- Select a severity.
- Type an optional note describing why the change is necessary.
- Click Save.
- Expand Case Timeline to view the chronological log of all analyst actions, notes, status changes, and escalations taken on the case.
-
After triaging and reaching a resolution, click Close Case.
- In the Close Case window, do the following:
- Select a resolution.
- In the Note box, type an optional note that describes your reasoning for the resolution.
- (Optional) If you want to resolve all of the findings associated with the case, click the check box next to Also close associated findings, then select the resolution you want to apply to each finding.
- Click Save.
Reopening a closed or expired case
A case can be moved back to Investigating from Closed or Expired. This does not send a new notification. It allows you to close the case with a different resolution. The original resolution note is not editable, but an additional note can be added when you close the case again.
If Blumira detects a new threat within 7 days of a related case being closed or expired, even if you reopen the case, Kindling creates a new case and links it to the prior one via the Related Cases section. The old case does not automatically reopen.
To reopen an expired case or to update the resolution on a closed case, do the following:
- Click Reopen Case.
- Type a note explaining the need to open it.
- Click Reopen.
Case resolutions
When closing a case, you must select a resolution. The table below describes when to use each resolution.
| Resolution | When to use it |
|---|---|
| Administrative Activity | Activity was performed by an admin as part of routine system management |
| Approved Testing | Activity was part of authorized security testing or a red team exercise |
| Environmental / Software Noise | Detection fired due to known software behavior, tooling, or environmental conditions rather than a real threat |
| Confirmed Threat | Real malicious activity was identified — the case represents a genuine security incident |
| Policy Violation | A policy was broken but the activity was not malicious (e.g., unapproved software, personal device use) |
| Misconfiguration | Detection was triggered by a misconfiguration rather than malicious or intentional activity |
| Inconclusive | Investigation could not determine with confidence what the activity represents |
| Authorized Use | Activity was legitimate and approved for this user or context, but not routine enough to classify as administrative |
| Other | None of the above apply |
Alerts & notifications
Kindling sends case alerts based on the severity thresholds you configure for your organization. You can receive an alert when a case is first created at your chosen severity level, and when an existing case is escalated into that severity level or changes status.
Notifications are off by default and are configurable from the Notification Settings page in Blumira.
Navigating and viewing organization dashboards
The Kindling dashboard provides a real-time view of your security posture, with business context and data that includes the following:
- A list of integrated log sources
- An activity timeline showing the account’s finding frequency over the past week, broken down by severity and status. The timeline is useful for spotting unusual spikes.
- A list of active cases needing attention.
- An inventory of entities that shows the users, devices, and IPs appearing in your agent logs, cross-referenced with findings and cases to show relationships
- A security posture assessment with tips on what to focus on to improve the rating
- A list of recent findings
Note: An individual organization’s dashboard differs from the MSP Dashboard, which provides a portfolio view of all the Blumira accounts you manage or have access to.
MSPs managing multiple organizations in Blumira
If you manage multiple Blumira accounts, the top-level MSP Dashboard in Kindling provides an overview of your managed portfolio's key metrics across all child organizations, offering insight into data health and size. The dashboard highlights your most urgent sub-accounts that need attention, as well as operational efficiency data, license distribution, and a timeline of activity to help you visualize finding frequency.