Investigations

Investigations lists your cases. A case opens when a detection fires, or when someone opens one for a question. Open it from the sidebar or press g then i. You need the investigation.read permission to see it.

For how cases work, see Investigations concepts.

Find a case

By default the list shows Open cases (every state except resolved). Use the filters to narrow it:

• search by title, entity, technique or ID
• State, Severity and Trigger

Columns include Severity, Case, Primary entity, State and Updated. Use a row's menu to Open case or Copy link.

Open a case for a question

1. 1

   Choose New investigation. You need the investigation.run permission.

2. 2

   Fill in the case. Enter a Title, choose a Severity (Medium by default) and, optionally, a Question that says what the investigation should establish.

3. 3

   Choose Open case.

Work a case

The case page shows the severity, state and trigger, and a progress bar from Detected through Investigating, Plan proposed, Awaiting approval, Remediating and Verifying to Resolved. A Next step callout tells you what to do, for example Review plan when a plan is awaiting approval.

The page is organised in sections:

• Evidence timeline and Evidence: source observations grouped by type and source, with their provenance. Sensitive evidence is marked.
• Hypotheses: each claim lists the evidence that supports and contradicts it, a confidence level and the alternatives considered. A hypothesis is Open, Supported, Refuted or Inconclusive.
• Action plans, Related entities and Findings linked to the case.
• Notes: use Add a note for observations, decisions and hand-off context, then choose Add note.
• Outcome: what was decided when the case was resolved.

Propose a fix

Choose Propose plan to draft an action plan for this case. You need the action.propose permission. See Propose a plan.

Record a decision

1. 1

   Choose Record decision. It is unavailable while a plan is running.

2. 2

   Choose the Case state. You can move a case to Investigating, Awaiting information, Resolved or Escalated, depending on its current state.

3. 3

   Write an Outcome summary when resolving: what was established, what remains uncertain and how the case was handled.

4. 4

   Enter a Reason and choose Save decision. The decision is attributed in the case timeline and the audit log.

You cannot resolve a case while one of its plans is still pending. Cancel or reject the plan, or complete its recovery, first.

To reopen a resolved case, choose Reopen case. New evidence can also reopen a case. Reopening never repeats actions that already ran.