View an Investigation

When you view an Investigation, you will have access to all of the information our SOC analysts have. You can scroll through the areas to see what notes the SOC analysts made, or select the text on the left to see specific information about timeline, involved hosts, or others.

The information we gather in Workbench is retained for 15 months. After 15 months, it is permanently deleted.

View All Investigations

The Investigations page shows you all of the Investigations for your environment. You can find it by going to Activity > Investigations.

When you first open this page, you will see all Investigations sorted by the most recent.

Find a Specific Investigation

To find an Investigation:

• You can search for its number using the Search field (every Investigation has a number associated with it).

• You can use the filter options at the top of the page to filter by status, assignment, etc.

Select the blue name of the Investigation to open it.

Your specific Investigation screen may look different than the example below.