> For the complete documentation index, see [llms.txt](https://docs.dropzone.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dropzone.ai/dropzone-101/terms-and-defs/investigations.md).

# Investigations

**Investigations** are the core workflow in Dropzone. They represent the automated analysis of security alerts using the Dropzone AI SOC Analyst, combining alert data, contextual enrichment, and investigative reasoning into a single, reviewable case.

Investigations help security teams move from raw alerts to actionable conclusions quickly and consistently, reducing manual effort while maintaining analyst oversight.

***

## What Is an Investigation?

An investigation is created when Dropzone ingests a security alert from a connected alert source. The AI SOC Analyst then:

* Collects relevant data from integrated tools
* Enriches alerts with context and evidence
* Analyzes activity using investigative logic
* Produces a conclusion and supporting findings

Each investigation captures the full lifecycle of this process, from alert ingestion through final review.

***

## Investigation Outcomes

Every investigation results in a conclusion that reflects the AI’s assessment of the activity, such as:

* **Malicious** – Confirmed threat or attack
* **Suspicious** – Potentially malicious activity requiring attention
* **Benign** – Legitimate or expected behavior
* **Inconclusive** – Insufficient evidence to determine intent

These conclusions help teams quickly understand risk and prioritize response.

## Key Investigation Components

At a high level, investigations include:

* **Alert context** – Details about the triggering alert
* **Findings** – Key evidence and investigative insights
* **Evidence** – Data pulled from integrated tools
* **Conclusion** – The AI’s assessment of the activity
* **Review state** – Status indicating whether the investigation has been reviewed

Each component is designed to support fast understanding and informed decision-making.

## Prioritization and Workflow

Investigations are organized by priority—such as **Urgent**, **Notable**, or **Informational**—to help teams focus on the most critical work first.

They move through a clear workflow, from creation and analysis to review and closure, enabling scalable operations without sacrificing control.

## Why Investigations Matter

Investigations are the foundation of Dropzone’s value. They:

* Reduce alert fatigue by automating analysis
* Provide consistent, repeatable investigative outcomes
* Preserve transparency through evidence and reasoning
* Enable analysts to focus on high-impact decisions

By combining automation with human review, investigations allow teams to scale security operations while maintaining confidence and accountability.

## What’s Next

This overview introduces what investigations are and how they fit into the platform.\
For detailed guidance, see our [Best Practices Guide for Reviewing investigations](/best-practices/deep-dive-into-investigation-reviews.md)