Alert investigation is the process of reviewing an alert's event data, understanding what happened, and deciding how to respond. Security provides a detail view per alert with the raw event, related correlated alerts, asset context, and a place to record your analysis.
Opening an Alert
- Go to Security and open Alerts.
- Locate the alert in the queue. Sort by severity or filter by status New to find unreviewed alerts.
- Click the alert row to open the detail panel.
- The status automatically moves to Investigating once you open the detail.
Reading the Alert Detail
The alert detail view has several sections:
Summary bar — shows title, severity, source, MITRE technique, affected device or user, and timestamp at a glance.
Event data — the raw event that triggered the rule, shown as structured JSON. This includes fields like process name, command line, destination IP, file path, or user account depending on event type.
MITRE ATT&CK mapping — the technique and tactic the rule is mapped to. Use this to understand what stage of an attack this alert represents.
Affected asset — device name, IP, and client org. If the device is enrolled in RMM, a link to the device record is shown. See Asset Correlation for how Security links events to known assets.
Correlated alerts — other alerts that the correlation engine has linked to the same incident or attack chain. Review these to understand whether this is an isolated event or part of a broader pattern.
Timeline View
If the alert is linked to an incident, click View Incident to open the incident timeline. The timeline shows all alerts associated with the incident in chronological order, giving you a full picture of the attack sequence.
For standalone alerts not yet linked to an incident, you can still review correlated events by looking at the event data timestamps and cross-referencing in Threat Hunt.
Adding Analyst Notes
- Click Add Note in the alert detail to record your findings, reasoning, or next steps.
- Notes are timestamped and attributed to your user account.
- Notes persist on the alert record and are visible to other analysts working the same case.
Write a note any time you take an action or reach a conclusion — this keeps the record useful for review, escalation, or audit.
Recording a Verdict
After investigation, record your verdict:
| Verdict | When to use |
|---|---|
| Convert to Incident | Confirmed or suspected true positive — starts a full investigation workspace |
| Mark as False Positive | Alert fired on benign activity that looks malicious; note why |
| Mark as Benign | Activity is real but not a threat in this context; note why |
| Close | Reviewed and resolved without further action needed |
False positive and benign verdicts are stored in the alert feedback record and surfaced in Alert Tuning. If you see the same false positive repeatedly, act on the tuning suggestion to suppress it at the rule level.
Escalating to an Incident
To start a formal investigation:
- Click Convert to Incident in the alert detail.
- Set title, severity, category, and assignee.
- Any correlated alerts the engine has already linked will be included.
- You can add more alerts to the incident from the incident detail view.
See Incident Management for the full incident workflow.
FAQ
Can I see the full raw event before the alert was normalized? Yes. The event data panel in the alert detail shows the raw event JSON as it was received, alongside the normalized fields the rule matched against.
What does it mean when correlated alerts are shown? It means the correlation engine identified a pattern — shared device, user, IP, or MITRE technique — across multiple alerts within a short time window. This is a signal that the alerts may be part of the same attack and should be investigated together.
I marked an alert as false positive but similar alerts keep coming. What do I do? Go to Alert Tuning. The system aggregates your verdicts and generates suppression or threshold suggestions when a pattern is clear. Approve the suggestion to stop the alert at the rule level.