Investigations

Basic information on investigations can be found in the Investigations terms and definitions page.

What You’ll See Here

The Dropzone Investigations Summary Page

• Investigations by priority Tabs showing Dropzone’s recommendation on what to review first:

  • Urgent

  • Notable

  • Informational

  These priority levels can be influenced using Custom Strategies.

• Not yet processed investigation status

  • Queued Alerts that have been ingested by Dropzone and are waiting to be investigated.

    • This stage is used when there are already 10 investigations running at once (the current system limit).

  • Running Alerts that are currently being investigated by your Dropzone analyst.

  • Stopped Alerts that have been ingested but not investigated by Dropzone for a variety of reasons, such as exceeding thresholds set in System Info or encountering an error.

    • To investigate these alerts, navigate to the Stopped page, locate the Alert, then click the refresh icon to the right.

    • Stopped alerts do not count against your license.

    Best practice: Want to know when an investigation is stopped? Work with your Dropzone team member to set up a notification Response Action.

• Investigation Filters Below the investigation priorities are filters and a search bar allowing you to narrow the view only to investigations you want to see. Filters are of the following types:

  • Review Status - Dropzone learns by reviewing investigations. This will show you how many you have reviewed.

  • Conclusion - The goal of Dropzone is to provide accurate conclusions. Fine tuning will allow you to influence how this happens.

  • Insight Tag - Insights about the content of the investigation added by the analyst during an investigation

  • Alert Type

  • MITRE Tactic

  • Attach Surface

  • Source

  Dropzone will save your last session upon exit. This means you will be able to continue your work where you left off instead of having to add filters every time.

• List of Alerts meeting filter criteria Below the filters are all alerts matching the search criteria that have been specified. The summary of alerts shows important information about the alerts including the date/time, the title, entities involved, source of the alert, initial Conclusion, and priority.

  • Alert Title - The Alert Title is a link that will open the detailed view of the investigation.

  • Priority - This can be changed directly from the summary page by clicking the dropdown. This works just like changing the conclusion from the detail page.

  • Conclusion - This can be changed directly from the summary page by clicking the conclusion dropdown. This works just like changing the conclusion from the detail page.

You can **bulk edit** Conclusion and Priority status by selecting multiple items (Checking the box to the left of the alert) which will pop up an option to update all rows that have been selected at the same time.

---

• Full investigation write-ups

  • Click the Alert Title of any investigation to see the detailed view:

    • The overall summary of the investigation in Alert Claim and Conclusion Reasoning

    • Detailed investigative context in Investigation Threads and Key Findings

    • Supporting artifacts in the Evidence Locker

    • Recommendations for Containment Actions (for Malicious, Suspicious, and Inconclusive alerts only)

    • A Notes section for team collaboration

    • A Changelog showing the full investigation lifecycle from ingestion to approval

  Best practice: Check out our guides on how to review an investigation and leave context memory.