> For the complete documentation index, see [llms.txt](https://docs.dropzone.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dropzone.ai/platform/investigations.md). # Investigations Basic information on investigations can be found in the [Investigations terms and definitions page](https://docs.dropzone.ai/dropzone-101/terms-and-defs/investigations). ## The Investigations Page

The Dropzone Investigations Summary Page

The Investigations Page is located in the left navigation under Investigations. Here you can: ### 1. Display Investigations by Priority Level and Processing Status Once Dropzone has completed an initial investigation, the AI includes a recommendation on what to review first. These priority levels can be influenced using [Custom Strategies](https://docs.dropzone.ai/platform/settings/custom-strategies). Click through the investigation priority tabs to display investigations that are: * **Urgent** * **Notable** * **Informational** Some investigations may not yet be processed. Click "More" to display investigations that are: * **Queued**\ Alerts that have been ingested by Dropzone and are waiting to be investigated. * This stage is used when there are already 10 investigations running at once (the current system limit) * **Running**\ Alerts that are currently being investigated by your Dropzone analyst. * **Stopped**\ Alerts that have been ingested but not investigated by Dropzone for a variety of reasons, such as exceeding thresholds set in [System Info](https://docs.dropzone.ai/platform/settings/system-info) or encountering an error. * To investigate these alerts, navigate to the Stopped page, locate the Alert, then click the refresh icon to the right * **Stopped alerts do not count against your license** {% hint style="warning" %} \*\*Best practice:\*\* Want to know when an investigation is stopped? Work with your Dropzone team member to set up a notification \*\*Response Action\*\*. {% endhint %} ### 2. Filter Investigations You may further filter investigations using either the search bar (to search for key words included in the alert, such as entities or tags) or by clicking the inverted pyramid to the right of it. This will cause the filter dropdowns to appear below the investigation priorities bar. Filters are of the following types: * **Conclusion** The goal of Dropzone is to provide accurate conclusions. Fine tuning will allow you to influence how this happens. * **Insight Tag** Insights about the content of the investigation added by the analyst during an investigation * **Interview** If the [AI Interviewer](https://docs.dropzone.ai/platform/settings/ai-interviewer) is enabled, you can filter based off the status of the interview (e.g. pending, finished, declined, etc) * **Containment Action** You can filter the status of any Containment Actions recommended (e.g. Ready to Run, failed, etc) * **Alert Type** * **MITRE Tactic** * **Attach Surface** * **Source** * **Has Reinvestigations** {% hint style="warning" %} Dropzone will save your last session upon exit. This means you will be able to continue your work where you left off instead of having to add filters every time. {% endhint %} ### 3. See a complete list of investigations meeting the filter criteria Below the filters are all investigations matching the search criteria that has been specified. The investigations page shows each individual investigation's: * Initial Conclusion and Priority * Start Time (the moment an investigation was opened after an Alert was received) * Alert Title * Entities involved * Source of the Alert * The Owner/Assignee ## The Triage Center Page You may change the Priority, Conclusion, Status, and Ownership of an investigation from the Triage Center Page. ### 4. Change investigation management/ownership You may assign investigations to members of your organization, as well as track their progress as the investigation moves through review. This improves improves team cohesion and prevents over-reviewing. To assign an investigation, click the dropdown under "Assignee." This will open the Triage Center Page. From there, search your people database and select the person you want to take over the investigation. ### 5. Edit Investigation Results You don't need to go into the detailed view of an investigation to edit the Conclusion and Priority—you can do it directly from the summary page. Click the dropdown under Priority or Conclusion to open the Triage Center Page. From there, click the Priority, Conclusion, or Review Status you want to change the investigation to, then click "Save." If you edit a Conclusion, you must leave notes in the Conclusion Edit Details text box to explain the change. {% hint style="info" %} You can also edit the Conclusion and Priority status by checking the box to the left of investigations labeled "Triage." You can bulk edit by selecting multiple rows at the same time. This will pop up an option to update all rows that have been selected to the same result. It does not open the Triage Center Page. {% endhint %}

The Triage Center Page

*** ## Investigation Review Clicking an Alert Title will open the detailed view of the investigation. There you will find a full investigation write-up, which you can use to review investigations for accuracy and examine the reasoning of the AI agent. Full investigation write-ups include: * The overall summary of the investigation in **Alert Claim** and **Conclusion Reasoning** * Detailed investigative context in **Investigation Threads** and **Key Findings** * Supporting artifacts in the **Evidence Locker** * **Recommendations** for Containment Actions (for *Malicious*, *Suspicious*, and *Inconclusive* alerts only) * A **Notes** section for team collaboration * A **Changelog** showing the full investigation lifecycle from ingestion to approval {% hint style="info" %} **Best practice:** Check out our guides on how to [review an investigation](/best-practices/deep-dive-into-investigation-reviews.md) and [leave context memory](/best-practices/context-memory.md). {% endhint %} ### 6. The Tasks View For a quicker investigation review process, rather than view all your investigations in a list, they can be automatically sorted according to Review Status. Review Statuses include: * **New** - Unreviewed and unassigned investigations * **In Progress** - Actively undergoing review * **On Hold** - Review was placed on hold by a member of your organization, likely awaiting new information or outside action * **Closed** - Fully reviewed and closed To view your tasks, click the "Task" button at the top of the investigation page.

The Dropzone Investigations Tasks Page

Here you can sort investigations by Conclusion, Alert Title, Alert Time, Investigation ID, Recent Activity, and Priority. Use the same Filters that are available in the Investigation List View to include or exclude investigations. Each task will include the investigation's: * Priority * Alert Title * Associated Entities * Conclusion Click on "Show Reasoning" to view a summary of the AI's conclusion reasoning. If the conclusion matches with the evidence and organizational context, click the button labeled "Close Investigation." This is perfect for if you need to process a high volume of investigations in a short time frame. You can also click "View Details" to open the detailed view of the investigation in question. Use the normal [investigation review process](/best-practices/deep-dive-into-investigation-reviews.md) from there.