Investigations
Gather related alerts on one board, test hypotheses against the evidence, and keep a snapshot that can be shown and checked later.
An investigation is where an alert that turned out to matter is worked on: the alerts that belong together, the evidence, the analysts’ reasoning and its outcome.
Opening one
Section titled “Opening one”- Escalate an alert (E in the queue): an investigation is opened for it, unless the alert is already in one.
- From Investigations → New Investigation, with a title and priority.
| Field | Values |
|---|---|
| Status | open, investigating, contained, resolved, closed |
| Priority | P1 (highest) to P4 |
| Owner | The analyst responsible |
| Linked | Alerts, evidence and indicators of compromise |
The board
Section titled “The board”Each investigation has a canvas. Alerts, evidence, indicators and notes are cards; links between them say how they relate.
Suggestions. The board proposes the cards and links that the linked alerts’ own data supports — alerts on the same host, chained in time — and you accept the ones that hold.
Timeline. The cards laid out by when their events happened, in lanes by type or by host. Selecting a range on it selects those cards on the board.
Pivots. A card can ask the platform what else it knows about its subject: the raw events that mention a host or indicator within six hours either side of an alert, or the scans of a file hash. The answer lands on the board as an evidence card linked to the card it came from. The platform writes that card itself — the query, when it ran, how many rows, and a hash of the rows — so it cannot be typed in from the browser.
Hypotheses. Notes can be marked as hypotheses. The ACH matrix (analysis of competing hypotheses) sets every hypothesis against every piece of evidence: a supports link counts as consistent, a contradicts link as inconsistent. Hypotheses are ranked by how much evidence contradicts them, because evidence that fits usually fits several explanations, while evidence that contradicts one rules it out.
Explain. A written account of the board. The facts are assembled by the platform from the cards; the AI model only phrases them, and if no model is available you get the facts alone.
Working together
Section titled “Working together”- Everyone on the investigation sees each other’s presence and changes as they happen.
- Each card has its own comments.
@namenotifies that user of your tenant, and only them, with a link to the card. - Every change can be undone and redone. Deleted cards can be restored; deletion and restoration are written to the audit log.
Snapshots
Section titled “Snapshots”A snapshot freezes the whole board as canonical JSON with its SHA-256, who took it and when. Snapshots are never edited or deleted. Opening one recomputes the hash, so a snapshot altered after the fact shows that it was. A snapshot opens read-only.