Skip to content

Investigate Pane Overview

The Investigate Pane in the SenseOn platform is the primary workspace for reviewing, analysing, and responding to security cases. Designed to streamline investigation workflows, it offers case management tools, detailed timelines, contextual visualisations, and actionable response options, all in one place.

Key Functions of the Investigate Pane

The pane is divided into several functional areas to help you understand threats quickly and take effective action:

1. Case Management

Efficiently track and manage the lifecycle of each case:

  • Case Prioritisation
    High and critical scoring cases are automatically prioritised and surfaced, ensuring attention is focused where it’s needed most.

  • Case Scoring
    Each case carries three scores that together describe how the platform assessed the threat:

  • Severity: overall danger level of the activity (Critical, High, Medium, Low)
  • Confidence: how certain the platform is that the activity is genuinely malicious (High, Medium, Low)
  • Score: a composite numeric value (0–100) combining severity and confidence, used for sorting and filtering

An observation's score can be adjusted after detection where similar activity has been recurring in your environment. See Automated Triage for how to read those adjustments.

  • Correlation Source
    Every case records which engine correlated its observations into a case. Most cases are correlated by the SenseOn engine. Where the observations were instead grouped by an external engine, for example Microsoft folding alerts into an incident, the case carries an amber External correlation badge on its case card and in the case header. The badge tells you at a glance that another engine, rather than SenseOn, decided which observations belong together, which is useful context when you assess how the case was assembled. To see the engine behind an individual observation, open its detail panel and read the Correlated by row. Where a case brings together observations correlated by different engines, each observation row shows the engine that correlated it, so you can tell external and SenseOn correlation apart within a single case.
  • Case States
    Update the status of cases as investigations progress, which helps tracking key metrics such as MTTR:
  • Open: Default state for new cases.
  • In Progress: Case is actively being worked on.
  • In Review: Case is under peer or managerial review.
  • Closed: Case has been resolved.

Change a case's status from the status menu in the case header. Selecting an open status (Open, In Progress or In Review) on a closed case reopens it. Selecting Close case… from the menu opens the close form rather than closing the case straight away (see Closing a Case below).

  • Outcome Categorisation
    When closing a case, assign an outcome to assist with metrics and model tuning:
  • True positive: Malicious activity detected.
  • Benign true positive: Potential malicious activity but no threat.
  • False positive (incorrect alert logic): No malicious activity detected due to incorrect alert logic.
  • False positive (incorrect data): No malicious activity detected due to incorrect data.
  • Undetermined: The outcome of this case could not be determined.

The standalone False positive outcome can no longer be selected when closing new cases—choose one of the two false-positive variants or Undetermined instead. Cases previously closed as False positive continue to show that outcome in their history.

  • Closing a Case
    Select Close case in the case header to open the close form at the top of the case side panel. Choose an outcome, add a closing comment if you need one, then select Save and close. The form keeps its draft per case, so you can switch between cases without losing what you have entered, and Cancel discards the draft. You can also open the same form from the Close case… option in the status menu.

  • User Assignment
    Cases can be assigned to a specific analyst. Use assignment to distribute workload across your team and to make shift handover clear. Assigned cases appear in the assignee’s personal queue on the Overview.

  • Investigation Notes
    Add comments to document your findings, decisions, or handover context. In the Investigate module, comments are added from the case header and listed in the case side panel. See The Case View Side Panel.

1a. The Case View Side Panel

When you open a case in the Investigate module, its details appear in a side panel beside the knowledge graph. On the case overview, the panel is organised into sections, from top to bottom:

  • Case Overview
    The SenseOn AI case summary, the case's Comment history, and, on a closed case, a Case closed summary showing the closing category and closing comment.

  • Resolve investigation
    A collapsible section, expanded by default, showing the Resolve verdict for the case. It collapses automatically when the case is closed and expands again if the case is reopened. It is hidden for cases that have no Resolve result.

  • Observations
    The observations that make up the case.

  • Timeline
    A collapsible section, collapsed by default, holding the case history: state changes, assignments and other events logged over the case's lifecycle. This is distinct from the observations timeline along the bottom of the pane.

  • Response Overview
    The case's response actions. It opens automatically when the current view (the case overview or a selected observation) has response actions, and stays collapsed when there are none, until you toggle it for that case.

Adding and reviewing comments

A Comment control in the case header opens a comment box at the top of the side panel:

  • Type your comment and select Comment to save it, or Cancel to discard the draft. The button confirms with Comment added, then the box clears and closes after a few seconds. If the save fails it shows Comment not added. Try again. and keeps your draft so you can retry. The box stays open while you move between observations, graph nodes and edges, so you can keep gathering detail without losing your draft. Each case keeps its own draft, so switching cases and returning brings the box back as you left it. Selecting the control again hides the box but keeps the draft.
  • Saved comments appear in Comment history in the Case Overview, newest first, as chat-style bubbles showing the author, the comment text and the time, with an "edited" marker if the comment was later changed. Hover or focus one of your own comments to reveal a menu for editing or deleting it.
  • Closing notes appear in the same Comment history, each marked with a case close tag. If a case was closed with an outcome but no closing comment, Comment history prompts you to Add a closing comment.

2. Case Investigation Workflow

Investigate incidents more efficiently with built-in intelligence and structured data views:

  • SenseOn AI Case Summary
    Every case includes an automatically generated summary offering produced by the SenseOn AI LLM:
  • Root cause analysis
  • High-level impact description

  • Key entities involved

  • Observations Timeline
    A chronological, to-scale view of observations contributing to the case. Helps you:

  • Understand the sequence of events
  • Correlate related activities
  • Identify dwell time or spread patterns

Hovering an observation shows a tooltip that includes its source and how it was correlated, so where a case mixes external and SenseOn correlation you can read that attribution directly on the timeline.

Where an observation triggered a Reflex or Endpoint Protection response action, that observation's single timeline node also carries a response status icon, shown beside the crosshairs marker above the node. The action appears on its own observation's node rather than as a separate point on the timeline. Select the status icon to jump straight to that action in the response overview, where you can read its current status and any notes.

  • Shareable Observation Links
    As you open an observation, the browser address bar updates to point at it, so the observation you are viewing has its own link. You can bookmark, reload or share that link, and it reopens the case with the same observation selected. Selecting a different observation updates the link in place rather than adding a browser history entry, so back and forward step between cases, not between observations. Open another case, or leave Investigate and use the browser's back button, and the case reopens at the observation you had open. Returning to Investigate from the left-hand menu opens the case overview instead. If the linked observation is no longer part of the case, the link opens the case overview instead and shows a brief notice.

3. Knowledge Graph

Explore the relationships between entities involved in a case using an interactive visual graph:

  • Entity Relationship Mapping
    View how users, processes, endpoints, and destinations interact.

  • Process Tree Integration
    Drill into any observation to trace a process’s full execution lineage.

  • Collaboration Tools
    Add comments to specific elements in the graph for shared context across your team.

  • Device Details
    Select a device in the graph, or open it in a case's devices list, to see its details grouped into what the device reported at the time and its current state:

  • Device details at time of observation lists the values captured with the observations, such as Hostname, Device ID, IP address, Device type, User, and Location. These are fixed, so you always see the device as it was when the activity occurred. The section notes when they were captured, or how many observations captured them where more than one recorded the device, and that they won't change.
  • Real-time Universal Sensor data lists the device's current state as reported by the SenseOn Universal Sensor, including Isolation status, Last seen, OS type, Agent version, and Segment. These refresh while the case is open, so they stay current even while you have an observation selected, and the section shows when it was last retrieved.
  • A Real-time section for each configured third-party EDR appears where that vendor's integration covers the device, named after the vendor and listing its current details for the device.

4. Telemetry Record Analysis

Advanced users can access the raw telemetry behind each observation:

  • Inspect low-level details like file paths, data transfers, registry changes, command lines, or parent-child process relationships.
  • Pivot into Hunt Lab for comprehensive granular reviews of observed activity

5. MITRE ATT&CK Mapping

Each observation is mapped to at least one appropriate MITRE ATT&CK technique:

  • Understand the adversary’s likely objectives and tactics.
  • Use this to correlate detections with known attack chains or threat actor behaviour.
  • Click any technique name to open the MITRE ATT&CK technique lookup, which shows the full technique description, sub-techniques, and known threat actor associations directly within the platform.

5a. Evidence Management

The evidence panel within a case lets you attach and track supporting artefacts gathered during your investigation:

  • Upload files: attach screenshots, memory dumps, log extracts, or any other artefact relevant to the case
  • Link observations: manually link additional observations from the Experience module to a case if they are related but were not automatically grouped
  • Add external references: record links to external threat intelligence sources, ticket numbers, or documentation
  • Evidence notes: annotate each piece of evidence with context to assist teammates or for later review

Evidence is retained with the case and included in any case export.

6. Active Response Options

Where supported, and if you have Active Response access, respond directly to threats from the Investigate Pane:

  • Isolate Device
    Immediately remove a compromised device from the network.

  • Kill Process
    Terminate malicious or suspicious processes before they can escalate.

  • Delete File
    Remove known malicious files from affected endpoints.

  • Remote Session
    For advanced users, open a remote session to:

  • Pull forensic artefacts (e.g. file contents, hashes)
  • Run custom diagnostic commands
  • Apply containment rules (e.g. firewall changes, removing persistence mechanisms)

Best Practices

  • Always update the case state and outcome when closing to ensure accurate threat metrics and SOC reporting.
  • Use the SenseOn AI to kickstart investigations.
  • Use the Observations Timeline to understand event sequencing and kill chain progression to reduce time to resolution.
  • Leverage the Knowledge Graph to trace process trees, lateral movement or uncover hidden entity relationships.
  • Add notes or comments for cross-team visibility and case handover clarity.