Investigation Reviews Deep Dive

New to Dropzone? We recommend starting with our overview of The Platform, specifically the Dashboard and Investigations sections, to familiarize yourself with how alerts flow through the system.

Once you’re comfortable, you’re ready to begin reviewing investigations.

Overview: Investigation Reviews

Investigation Reviews enable SOC analysts to validate AI-completed alert investigations for accuracy and completeness. This process ensures high-quality security analysis while creating feedback loops that continuously improve Dropzone’s automated investigation capabilities.

Reviews help:

• Confirm AI conclusions align with your SOPs

• Reduce false positives

• Capture institutional knowledge

• Improve future investigation accuracy

You may follow your existing Standard Operating Procedures (SOPs) or use Dropzone’s built-in Quality Assurance checklist when reviewing investigations.

---

What You’ll See Here

• Investigation Queue Management Efficient filtering and prioritization of completed investigations

• Review Interface Navigation A walkthrough of all investigation review components

• Feedback Systems Context Memory creation and Custom Strategy development

• Quality Assurance Workflows Structured approaches to validating investigations

• Outcome Management Conclusion changes and investigation status updates

• Knowledge Base Integration Leveraging reviews for long-term organizational learning

---

How Investigation Reviews Work

Review Process Model

1. Investigation Completion The AI completes an automated investigation of security alerts.

2. Review Queue Completed investigations enter the review queue with an In Review status.

3. Analyst Assessment Human analysts evaluate the AI’s conclusions, evidence, and reasoning.

4. Feedback Integration Review outcomes improve AI performance through Context Memory and strategies.

5. Status Updates Investigations move from In Review to Reviewed.

---

Review Components

Investigation Data

Each investigation review provides access to:

• Complete Alert Context Original alert details, triggering rules, and metadata

• AI Analysis Results Investigative findings, evidence, and reasoning

• Supporting Evidence API calls, queries, and data sources used

• Recommended Actions Suggested follow-up steps based on the investigation outcome

Review Tools

• Approval Workflows Single-click approval for accurate investigations

• Conclusion Modification Ability to change investigation outcomes with justification

• Context Memory Creation Add organizational knowledge for future AI reference

• Custom Strategy Development Encode reusable investigation logic for alert patterns

---

Quality Assurance Model

Investigation reviews support structured quality assurance across several dimensions:

• Accuracy Validation Confirm AI conclusions match evidence and organizational context

• Completeness Assessment Ensure all relevant investigative angles were explored

• False Positive Reduction Identify and correct misclassified benign activity

• Knowledge Transfer Capture institutional expertise to improve future investigations

---

Accessing Investigations

Login and Tenant Selection

• Navigate to your Dropzone AI tenant home page (for example, https://mycompany.dropzone.app)

• If you have multiple tenants, use the tenant tree to navigate between environments

Investigation Queue Access

• In the left navigation menu, click "Investigations"

• Select investigations by Priority:

  • Urgent

  • Notable

  • Informational

• Use filters to refine results by:

  • Conclusion

  • Interview usage

  • Source

  • And more

The Investigation Summary Page - Filters

---

Investigation components

Each investigation contains multiple sections, detailed below.

Notes

Located in the upper right, the Notes section is a space for analyst observations and feedback to allow for team communication around the investigation.

Notes currently do not influence AI behavior directly.

Investigation Threads

Here you will find the AI-generated questions guiding the investigation.

Click the carrot on the right of each question to expand and view all findings derived from Evidence Locker entries, including:

• Thread Findings A detailed view of all information used in the finding (device information, filenames, logins, user IDs, etc)

• Sources Queried A list of all sources used in the finding

• Additional Threads Further questions generated by the result of the finding

Actions

Here you will find a graph of the AI's actions throughout the investigation, grouped by stage.

You may also click the button labeled "AI Action Graph" in the Table of Contents to see this visualization.

Example Investigation Header

Alert Claim

An overview of the triggering alert and detection rule. Below is a list of Associated Entities (Hosts, users, IP addresses, and other related entities) involved in the alert.

Click "View All Details" to see the root code run and returned during the investigation.

Conclusion Reasoning

The AI-determined outcome with supporting context and confidence. Below is a list of applicable Insight Tags detailing the content of the investigation, such as common scams and flagged behaviors.

Example Investigation Summary Section

Key Findings

Summaries of the five most significant findings influencing the AI’s conclusion

Interviews Tab

This feature is only available if AI Interviewer is enabled.

Here you will find a record of all interactions with the AI interviewer involved in this investigation.

• Interview Details State, creation time, last update, and recipient

• Interview Question and Context The question asked and why it was generated

• Resulting Communications Full conversation if the recipient responds

• Approval Button Available when auto-approval is not enabled

Containment Actions

Here you may add containment actions based on the investigation outcome. To do so, do the following:

• Click "+ Add Actions"

• Select the action you wish to perform, e.g. "Contain Device"

• Enter the entity you wish to contain, e.g. "desktop1"

• Add actions until done

• Click "Save"

Example Investigation Containment Actions

Recommendations

A list of recommended remediation actions to contain the threat. You may mark them as completed by clicking "Mark complete" on the right

Remediation recommendations are not shown for investigations concluded as Benign or Inconclusive.

Example Investigation Recommendations

Evidence Locker

A record of all evidence used in the investigation.

• Source The external systems accessed during the investigation

• Request The specific query and/or action performed by the AI

• Response Click "View Response" to see the raw and processed results from each source

Changelog

A chronological record of all investigation events, including prior review activity and modifications.

---

Investigation Review

Standard Approval Process

• Verify the Conclusion aligns with your SOPs

• Select Close to keep the same Conclusion

• The investigation moves to Reviewed

Conclusion Modification

If the conclusion does not align with your SOPs, do the following:

• Use the dropdowns in the top-right to update the Conclusion to:

  • Malicious

  • Suspicious

  • Inconclusive

  • Benign

Dropzone treats Malicious and Benign as final states, but teams may use statuses however best fits their workflow.

• Add notes explaining why the Conclusion was changed

These notes may be used to guide context memory if the investigation status is changed to either Malicious or Benign. To improve future Dropzone analysis, check the box labeled "Use this note to guide context memory generation."

• Click "Save" to move the investigation to Reviewed

Example Investigation Review

---

Onboarding Recommendation

During onboarding, we recommend reviewing 10–15+ investigations per day for the first few weeks, prioritizing:

• Urgent

• Malicious

• Suspicious

This accelerates alignment with your internal SOPs and helps tune Dropzone quickly.

---

What’s Next?

Once you’re comfortable reviewing investigations, explore our Best Practice guides for:

• Building Custom Strategies

• Setting up Response Actions

• Leveraging Context Memory

Some advanced features are available to Admins only.