ARTEX AI project_context_hook and per-investigation state files
Detects the execution of the AI prompt hook script 'project_context_hook.py' or the creation/modification of the associated investigation state files (scope.md, surface.md, notes.md) within the same folder.
Microsoft Sentinel (KQL)

