In progress — this area is still being built; some actions described may not be available yet.
When an alert is raised, the investigation workflow gives you everything needed to determine whether the activity is malicious, understand how far it spread, and decide on the right response action. This article covers how to open a detection, read the process tree, review file and network context, and work through the event timeline.
Detection availability: Detection evaluation is currently limited and may not be live in your environment, so alerts may not appear for activity on enrolled devices. This article describes how the workflow runs when detections are evaluating; it does not promise a working first detection today. No alerts does not mean a device is clean.
Opening a Detection
- Go to Alerts. Critical items appear at the top.
- Click an alert to open the detail view.
- The detail view shows:
- The rule that fired and its mapped MITRE ATT&CK technique.
- The device, user, and timestamp of the triggering event.
- A link to any attack chain the alert has been grouped into.
If the alert is part of an attack chain, open the chain to see all related detections in sequence before investigating individual events.
Reading the Process Tree
The process tree is the most important context for a rule-based detection. It shows:
- The triggering process — the process that matched the rule.
- The parent process — what launched the triggering process.
- The command line — the full command used to start the process, including arguments.
- Ancestor processes — the chain of parent processes going up to the session root.
Use the process tree to answer: was this process launched by something legitimate (a user double-clicking an application), or was it spawned by an unexpected parent (a browser launching a shell, or a document reader spawning a script interpreter)?
Reviewing File and Network Context
Below the process tree, the alert detail includes associated file and network activity observed during the same event window:
File context:
- Files read, written, deleted, or renamed by the triggering process.
- Full paths, not just filenames.
Network context:
- Outbound connections made by the triggering process.
- Destination IP, port, and domain (if resolved).
- Whether the destination matched a threat intelligence indicator.
Working Through the Timeline
The event timeline shows the sequence of events on the device leading up to and following the detection. Use it to:
- Establish what happened before the alert fired — logins, process launches, downloads.
- See what happened after — did the process make additional network connections, drop files, or launch child processes?
- Identify lateral movement — did activity on this device precede similar detections on other devices?
The event warehouse retains 90 days of raw telemetry. For deeper investigation beyond the alert window, Threat Hunt is retired on this arm and is not part of this workflow. Work from the alert, case, device and attack-chain surfaces instead.
Converting to an Incident
If the investigation confirms malicious activity, click Convert to Incident. This promotes the alert (or the full attack chain) into a tracked incident with its own notes and evidence log. You can add investigation notes and attach evidence from within the incident view.
Marking False Positives
If the activity is legitimate, click Mark False Positive and add a note explaining why. This feedback is used by the suppression engine to reduce recurrence of the same alert pattern. Consider also creating an exclusion if the same process or path is expected to trigger the rule repeatedly.
FAQ
How do I see all activity from a specific device, not just one alert?
Open the device in the Devices view. The device detail shows recent alerts, trust score, and a link to run a threat hunt scoped to that device — note that the hunt route is retired on this arm, so that link answers hunt_store_retired rather than returning events.
Can I see activity from before the 90-day warehouse window? No. Events are retained for 90 days. For longer retention, export detection summaries from the Reports section before they age out.
What is the difference between an alert and an incident? An alert is a single detection or group of correlated detections. An incident is a manually escalated record that tracks an active or confirmed breach, with notes, evidence, and an assignee. Alerts do not automatically become incidents.