Track a detection investigation
Investigation tracking enables you to track how a detection is reviewed and resolved with the ExtraHop system.
You can set an investigation status for a detection,
assign the investigation to yourself or another ExtraHop user, and add notes about the
investigation. You can also filter your view of detections to show detections with a
specific investigation status or assignee.
Before you begin
Users must have limited write privileges or higher to set a detection status, assign a detection, or leave investigation notes.Here are important
considerations about tracking detection investigations:
- The Acknowledged or Closed status does not hide the detection.
- The investigation status can be updated by any privileged user.
- Optionally, you can configure investigation tracking with a third-party system.
- If you are currently tracking investigations with a third-party system, you will not see ExtraHop system investigation tracking until you specify it in the Investigation Tracking Administration settings.
To track an investigation, complete the following steps:
Thank you for your feedback. Can we contact you to ask follow up questions?