Investigate

Data analysis creates the notifications and, in turn, the aggregated cases. This section starts at what happens after a case is created: how an analyst reviews it, works down from the summary into the underlying events, and closes the loop by tuning the rule that fired.

The review workflow

1. Overview Summary: the queue of behavior-summary tickets (below).
2. Behavior Summary (case): pre-defined investigations and case status/ticketing.
3. Behavior Timeline: the chronological event view for the entity (in the v2 interface, Notable Events).
4. Investigation: event searching in the Data Lake.

note

In the v2 interface these pages are in the navigation rail: Overview Summary, Cases Search (each case opening on Behavior Summary), Notable Events, and Datalake Search; see Page Functionality. In the classic v1 interface they are found under the SIEM menu (Overview Summary, Behavior Summary, Behavior Timeline) and the Data Lake menu (Search); see Classic v1 interface.

Overview Summary

v2 interface

In the navigation rail, open Overview Summary (/v2/overview-summary).

The three counters at the top, OPEN (open behavior summaries), CLOSED BY AI (records closed automatically by the AI), and MTTR (the mean time to respond, measured on AI responses), summarize the behavior-summary tickets for the selected window.

Below them, the SEVERITY BREAKDOWN row has one tile per level (Critical, High, Serious, Medium, and Low), each giving the records of that severity shown in the list and, after the slash, the number of records of every severity that match the filters. Click a tile to narrow the list to that severity; Clear filter at the right end of the filter bar shows every severity again.

The filter bar sets what the list holds:

• Window: 1D (the default), 3D, 7D, 30D, 90D, or ALL TIME.
• Status: All (the default), New, Acknowledged, Closed, or Closed By AI.
• Sort: Highest risk first (the default), Newest first, or New / unclosed first.
• Show 0 score events: off by default, which lists only the summaries at or above the notification threshold of 3,000; ticked, the list holds every summary in the window, down to a score of zero.
• Refresh: reloads the counters and the list.

The list itself has the columns SUMMARY, ALERT DATE, RISK, and STATUS, and reads No summaries match this filter. when nothing matches. Click a summary to open it on Behavior Summary.

Classic v1 interface

Choose the Overview Summary option under the SIEM menu in the navigation bar (/SIEM/overviewSummary). The page is subtitled Overview of Fluency Behavior Summaries.

The three counter cards at the top, Total Tickets (all tickets generated in the period), Tickets Closed By AI (tickets resolved automatically, marked with a circled-x icon), and Open Tickets (tickets still awaiting review, marked with a warning-triangle icon), summarize the behavior-summary tickets listed in the Records section below, for the selected time range.

The time range is set by the button group in the upper right: 1D (the default), 3D, 7D, 30D, 90D, and ALL TIME, with a calendar icon beside ALL TIME for a Custom date range.

Two controls sit between the counters and the records list: a Show 0 score events checkbox, off by default, which includes zero-score events in the list when enabled, and a Severity Filter dropdown.

The Severity Filter dropdown holds a Select All checkbox (checked by default, so every severity is included) followed by one checkbox per level: Critical, High, Serious, Medium, and Low.

The Records list itself is filtered by ticket status with the tab bar on its right: All (the default), New, Acknowledged, Closed, and Closed By AI. When nothing matches, the list shows No records found; the footer bar reports the visible range and pages through longer lists.

To see how this table is dug into, continue to Investigating a Behavior Alert.

In this section

• Investigating a Behavior Alert: the worked end-to-end example, from ticket to raw record.
• Behavior Summary: the per-entity case view and its risk scores.
• Behavior Timeline: the chronological event view for an entity.

Related

• Detections: the rules that produce these behaviors.
• Events Search: where step 4 of the workflow above happens.
• Overview Summary: the screen reference for the queue (v1: SIEM → Overview Summary).