Complete the investigation
Answer playbook questions and connect evidence to each required step.
Work the playbook
- Open the alert’s Investigation area and read the attached playbook and version.
- Complete each required step according to its kind: check an activity after doing it, save an answer to a question, or connect evidence references and explain their relevance.
- For an evidence step, attach or retrieve the supporting material before marking it complete. A tick alone is not proof that the requirement is satisfied.
- Revisit missing-step messages before attempting a terminal decision. If a newer playbook is available, review the adoption action and its implications for this alert before applying it.
Gather and record support
Available investigation queries include Pull 90-day transactions, Find prior alerts, Find prior cases, and Scan linkages. Queries needing a subject cannot run without one. These operations can attach a result to the alert: check its time, scope, and actual returned evidence before citing it.
Use Upload documents for supporting files. When unified notes are enabled, free-form notes are written in the Notes side panel and can be found in Workbook. Evidence, query results, system entries, and validated reused notes remain part of the alert record.
Manage information still needed
Record the outstanding request or follow-up shown by the investigation controls. When waiting prevents progress, use the documented hold workflow with a follow-up date. A requested item is not received evidence; review and attach the response before completing dependent steps.
After saving, confirm the answer, reference, or file is visible and the playbook progress has updated. If a save fails, keep your unsaved reasoning, retry the affected action, and verify the record before proceeding.