User guide
Investigations
Review past alert investigations, triage runs and result readouts.
Investigations keeps every alert investigation, batch triage run and query result readout, visible to the whole team. It needs the database.
- Filter by type (investigation, triage, result readout) or search by keyword.
- Open a record to see the full conclusion as it was, such as an investigation's timeline, evidence and actions.
- Start a new query about the device or interface a record is about.
For running investigations and triage, see Triage and investigation.