1. Expel Help Center
  2. Getting Started with Expel
  3. Activity

How to Reopen an Investigation

You can view investigations in Workbench. After an investigation is complete and no evidence of malicious activity was found, the investigation is closed. You can view closed investigations and see why they were closed.

Use the filter options at the top of the Activity page to select status as Closed. You can also filter on several specific closed reasons. Select the closed investigation you want to see.

Review the information in the investigation.

When you view an investigation, you have access to all the information the SOC analysts have. Scroll through the areas to see what notes the SOC analysts made. Select the text on the left to see specific information about timeline, involved hosts, and more. You may be assigned a remediation action.

You can add notes about this investigation by selecting the Add Comment on the Investigative Actions screen. You can also add information to the Timeline screen by selecting Add Timeline Event. These additions can be seen by the SOC analysts, too.

You can reopen the investigation after you review it; perhaps you don't agree with this investigation being closed or simply want more information. Select Update Investigation at the top of the page. Select Reopen and then select Save.

Reopen_Investigation.png

After you reopen the investigation, you should add comments or other notes about why you reopened the investigation. If you want the SOC analysts to help, you can assign the investigation to them. Select Update Investigation at the top of the page.

Update_Investigation_DB.png

 

You have multiple actions available to you here:

  • You can assign the investigation back to the SOC analysts. For example, you did the remediation actions recommended and want further information from the SOC analysts.
  • You can close the investigation. For example, after you review what's happening, this is benign and no further action needs to be taken. The dialog box changes for you to provide a reason to close and to make notes.
  • You can upgrade the investigation to an incident. For example, you review what's happening and this might be a threat in your environment. The dialog box changes and prompts you for more information about what's going on.

    If you think this is a critical incident (a security breach may be happening right now), provide as much information as you can to help the SOC analysts or your team if that's who you loop in. The more information you can provide, the better the response is from the SOC analysts or from your team. Make sure you assign the incident to Expel if you want the SOC analysts to help.

    Note
    If you want the SOC analysts to do more analysis, assign the incident to Expel. You can still work the incident on your side, but this flags the incident for the SOC analysts, too.

Related articles