Start Demo

Investigations

(NDR module only) Investigations enable you to add and view multiple detections in a single timeline and map. Viewing a summary of connected detections can help you determine whether suspicious behavior is a valid threat and if a threat is from a single attack, or part of a larger attack campaign.

You can create and add to investigations from a detection detail page, the Actions menu on an individual detection card, or the Bulk Actions menu on a detection summary. Your ExtraHop system will also create recommended investigations through Smart Investigations, which are investigations automatically created in response to potentially malicious activity.

Each investigation page includes the following tools:
Investigation Timeline

The investigation timeline appears on the left side of the page and lists the added detections, beginning with the most recent detection. New detections that are added to the investigation appear in the timeline according to the time and date the detection occurred. Detection participants are displayed under the detection title and detection tracking information, such as assignee and status, is displayed next to the participants.

Attack Categories
The categories of the added detections are displayed across the top of the investigation page.

The attack category chain displays the number of detections in each category, not the order in which the detections occurred. Refer to the investigation timeline for an accurate view of how the detections occurred over time.

Viewing investigations

At the top of the investigation page, there are two options for viewing the investigation: Summary and Attack Map. Both options provide a unique view of your investigation.

Summary
By default, investigations open in Summary view, which includes the detection timeline, an aggregated list of participants, and a panel for tracking the status and response actions for the investigation.

You can click a detection in the investigation timeline to view detection details, then click the x icon to close the detection details and return to the investigation summary. You can also click the go to icon in the upper right corner to view the detection details page in a new tab.

In the Participants panel, participants in the investigation are grouped by external endpoints, high value devices, and recurring participants, which are participants that appear in multiple detections in the investigation. Click on a participant to view details and access links.



In the Status and Response Actions panel, click Edit Investigation to change the investigation name, set the status or final assessment of the investigation, specify an assignee, or add notes.

You can continue to track individual detections after you add them to an investigation.
Attack Map
In Attack Map view, the offender and victim from every detection in the investigation are displayed in an interactive map next to the investigation timeline.

The participants are connected by lines that are labeled with the detection type, and device roles are represented by an icon.

  • Click a detection in the investigation timeline to highlight participants. Circles are highlighted in red if the device has appeared as an offender in at least one detection in the investigation and are highlighted in teal if the device is a victim. Highlights are updated when you click a different detection to help you identify when a participant changes from victim to offender.
  • Click a circle to view details such as the device hostname, IP address, or MAC address, or to navigate to associated detections or the Device Overview page.
  • Hover over any circle or line to display the label.

The ExtraHop Machine Learning Service monitors network activity for combinations of attack techniques that might indicate malicious behavior. When a combination is identified, the ExtraHop system will create a recommended investigation, enabling your security teams to assess the situation and respond quickly if malicious behavior is confirmed.

For example, if a device is the victim in a detection in the Command-and-Control category, but becomes the offender in an Exfiltration detection, the ExtraHop system will recommend a C&C with Exfiltration investigation.



You can interact with recommended investigations in the same way as user-created investigations, such as adding or removing detections, specifying an assignee, and setting a status and assessment.

Recommended investigations can be found in the investigations table. You can sort the Created By column to find investigations that were created by ExtraHop.

After a detection is added to an investigation, a link to the investigation appears at the bottom of the detection card and on the detection detail page.

Click the name to open the investigation and then click the name of the detection on the investigation page to return to the detection detail page.


Learn how to create an investigation.

Last modified 2025-04-04