Understanding Investigations

An Investigation is created for an Expel Alert when there is a need for more in-depth analysis to determine if the activity is malicious or benign. This is where Expel can perform additional actions (labeled Investigative Actions) to uncover more information and help determine the scope and nature of the activity that created the initial Expel Alert.

Every Investigation is eventually either flagged as an Incident because there is a potential threat to your environment, or closed as benign with no further action needed.

For more information about Incidents, including suspected threat types, suspected attack vectors, and suspected attack lifecycles, see Understanding Incidents.

Investigative Actions

Verify Action

If we need more information from you about whether or not a particular activity is suspicious, we will send a Verify Action. You can review these in Workbench by selecting Activity > Investigations.

Click on any listed Investigation to see the Verify Actions.

You have three options for responding to a Verify Action:

1. Not Authorized: Incident - the activity was not authorized by your organization and it should be investigated.

Selecting this option generally leads to the creation of an Incident.

1. Not Malicious: Close - the activity was not authorized by your organization, but is not concerning and therefore the Investigation can be closed.

This option is often used with policy violations or IT misconfigurations. Examples:

• A user logging into their employee email via a personal VPN, which is not normally allowed but their login activity was consistent to the user (normal geolocation, normal 2FA authentication, etc.).

• An IT admin downloading PIN testing software to practice for a certification, which is not malicious but perhaps was not formally authorized by your organization.

• A service account accessing more resources than was originally intended, due to an IT misconfiguration rather than attacker manipulation.

1. Authorized: Close - the activity was authorized by your organization, so the Investigation can be closed.

We continuously learn from your responses to Verify Actions. If you mark an activity as authorized, and the same authorized activity continues to happen, we may eventually create a Suppression for it. If the Verify Action is for authorized activity that you wish to continue to be notified about, choose the Not Malicious: Close option instead.

Notify Action

When we identify something that is not entirely malicious but is highly suspicious or a potential policy violation, we will send a Notify Action to recommend an action for you to take (such as gathering device data or uploading a file for our SOC analysts).

Close Reasons

There are several reasons why we may close an Investigation or Expel Alert.

The specific options you see in the dropdown menu will vary depending on your location within Workbench.

Reason	Meaning
Attack failed	An attacker made an attempt, but no compromise occurred. You may be advised to take additional steps to mitigate any risk posed by the failed attack, or the attack could be considered "normal" enough (e.g. web scanning) that we do not recommend any additional steps.
Benign	A signature fired on a specific point-in-time activity that it was looking for (i.e. webshell request or psexec activity), but the context of the activity does not represent a threat. Most behavioral signatures will fall into this category.
False positive	The logic and intent of the signature did not align, and the signature needs to be reworked. Examples include a login flagged as outside of the US, but the IP address is geolocated to Kentucky; or a binary flagged as malware, but the binary is a signature file.
Inconclusive	You are unable to make a strong call one way or the other because you lack sufficient evidence.
IT misconfiguration	Verified non-malicious activity was triggered by an IT issue, such as failed login attempts after an automated password change process.
Other	Any reason that does not fit into the other categories. In most cases, a specific close reason is added by an analyst.
Phishing simulation	The alert or investigation was a confirmed phishing simulation. This reason is unique to the Managed Phishing service.
Possible policy violation	Could be any of the following: Unauthorized activity that you are aware of and may have fixed/reverted (e.g. an engineer accidentally makes a resource publicly viewable, but the security team works with them to fix it). A non-malicious file NOT identified as PUP/PUA. Verified VPN activity, based source/destination IP or other parts of the alert (e.g. activity is on SurfShark VPN binary). Piracy, pornography, or a productivity-impacting activity.
PUP/PUA	Non-malicious files were identified as PUP/PUA at the time of the alert. We only categorize as PUP/PUA if two or more of the following vendors identify it as such: Microsoft, Sophos, F-Secure, McAfee, Malwarebytes, Kaspersky, Symantec, McAfee-GW-Edition, BitDefender. If two or more vendors do not indicate this categorization, it will be closed as a possible policy violation.
Suppressed	The alert has been automatically suppressed because it is a known benign issue.
Suppressed manual	The alert has been manually suppressed because it is a known benign issue.
Suppressed new device	The device is being tuned and is currently suppressed while the tuning process completes.
Suppressed threshold exceeded	The alert has been auto-closed because you have reached the threshold of alerts that can be associated with the investigation.
Testing	Verified internal testing activity.
True positive	The investigation or incident has been confirmed by you as true malicious activity or a valid threat.