1. Expel Help Center
  2. Getting Started with Expel
  3. Activity

Working with Investigations

As the SOC analysts watch your environment, they can surface alerts to you as investigations, which you can view in Workbench. If you set your notifications to alert you, you get a notification with enough information to generally know what's going on. If you see something you think warrants an investigation, you can create one. You can also reopen an investigation about which you want more information or whose resolution you disagree with.

WB_Investigations_Dashboard.png

You can use the filter options at the top of the page to view investigations you're interested in. For example, by status or assignment.

Every investigation has a number associated with it. You can search for the number using the Search field. Click the blue name of the investigation to open it. Your specific investigation screen may look different than our example below.

Investigations_specific_screen.png

Use the filter options at the top of the page to view what you're interested in. For example, by status or date.

When you view an investigation, you have access to all the information the SOC analysts have. Scroll through the areas to see what notes the SOC analysts made. Click the text on the left to see specific information about timeline, or involved hosts, or others. You may be assigned a remediation action.

You can add notes about this investigation by clicking the + Add Comment button on the Investigative Actions screen. You can also add information to the Timeline screen by clicking the + Add Timeline Event button. These additions can be seen by the SOC analysts, too.

You can also update the investigation after you review it. Click the Update Investigation button at the top of the page.

Update_Investigation_DB.png

 

You have multiple actions available to you here.

  • You can assign the investigation back to the SOC analysts. For example, you did the remediation actions recommended and want further information from the SOC analysts.

  • You can close the investigation. For example, after you review what's happening, this is benign and no further action needs to be taken. The dialog box changes for you to provide a reason to close and to make notes.

  • You can upgrade the investigation to an incident. For example, you review what's happening and this might be a threat in your environment. The dialog box changes and prompts you for more information about what's going on.

    If you think this is a critical incident (a security breach may be happening right now), provide as much information as you can to help the SOC analysts or your team if that's who you loop in. The more information you can provide, the better the response is from the SOC analysts or from your team. Make sure you assign the incident to Expel if you want the SOC analysts to help.

    Important

    If you want the SOC analysts to do more analysis, assign the incident to Expel. You can still work the incident on your side, but this flags the incident for the SOC analysts, too.

Related articles