Investigation Reviews Deep Dive

New to Dropzone? We recommend starting with our overview of The Platform, specifically the Dashboard and Investigations sections, to familiarize yourself with how alerts flow through the system.

Once you’re comfortable, you’re ready to begin reviewing investigations.

Overview: Investigation Reviews

Investigation Reviews enable SOC analysts to validate AI-completed alert investigations for accuracy and completeness. This process ensures high-quality security analysis while creating feedback loops that continuously improve Dropzone’s automated investigation capabilities.

Reviews help:

• Confirm AI conclusions align with your SOPs
• Reduce false positives
• Capture institutional knowledge
• Improve future investigation accuracy

You may follow your existing Standard Operating Procedures (SOPs) or use Dropzone’s built-in Quality Assurance checklist when reviewing investigations.

What You’ll See Here

• Investigation Queue Management\ Efficient filtering and prioritization of completed investigations
• Review Interface Navigation\ A walkthrough of all investigation review components
• Feedback Systems\ Context Memory creation and Custom Strategy development
• Quality Assurance Workflows\ Structured approaches to validating investigations
• Outcome Management\ Conclusion changes and investigation status updates
• Knowledge Base Integration\ Leveraging reviews for long-term organizational learning

How Investigation Reviews Work

Review Process Model

1. Investigation Completion\ The AI completes an automated investigation of security alerts.
2. Review Queue\ Completed investigations enter the review queue with an In Review status.
3. Analyst Assessment\ Human analysts evaluate the AI’s conclusions, evidence, and reasoning.
4. Feedback Integration\ Review outcomes improve AI performance through Context Memory and strategies.
5. Status Updates\ Investigations move from In Review to Reviewed.

Review Components

Investigation Data

Each investigation review provides access to:

• Complete Alert Context\ Original alert details, triggering rules, and metadata
• AI Analysis Results\ Investigative findings, evidence, and reasoning
• Supporting Evidence\ API calls, queries, and data sources used
• Recommended Actions\ Suggested follow-up steps based on the investigation outcome

Review Tools

• Approval Workflows\ Single-click approval for accurate investigations
• Conclusion Modification\ Ability to change investigation outcomes with justification
• Context Memory Creation\ Add organizational knowledge for future AI reference
• Custom Strategy Development\ Encode reusable investigation logic for alert patterns

Quality Assurance Model

Investigation reviews support structured quality assurance across several dimensions:

• Accuracy Validation\ Confirm AI conclusions match evidence and organizational context
• Completeness Assessment\ Ensure all relevant investigative angles were explored
• False Positive Reduction\ Identify and correct misclassified benign activity
• Knowledge Transfer\ Capture institutional expertise to improve future investigations

Accessing Investigations

Login and Tenant Selection

• Navigate to your Dropzone AI tenant home page (for example, https://mycompany.dropzone.app)
• If you have multiple tenants, use the tenant tree to navigate between environments

Investigation Queue Access

• In the left navigation menu, click Investigations
• Select investigations by Priority:
  • Urgent
  • Notable
  • Informational
• Use filters to refine results by:
  • Conclusion
  • Interview usage
  • Source
  • And more

Reviewing Investigations

Each investigation contains multiple tabs, described below.

Summary Tab

• Alert Summary\ Overview of the triggering alert and detection rule
• Top Findings\ The five most significant findings influencing the AI’s conclusion
• Associated Entities\ Hosts, users, IP addresses, and other related entities
• Final Conclusion\ AI-determined outcome with supporting context and confidence

Interviews Tab

Only available if AI Interviewer is enabled

• Interview Details\ State, creation time, last update, and recipient
• Interview Question and Context\ The question asked and why it was generated
• Resulting Communications\ Full conversation if the recipient responds
• Approval Button\ Available when auto-approval is not enabled

Findings Tab

• Investigative Questions\ AI-generated questions guiding the investigation
• Evidence-Based Rationale\ Reasoning derived from Evidence Locker entries
• Analysis Depth\ Detailed view of investigation methodology

Evidence Locker Tab

• API Call History\ All queries and lookups performed by the AI
• Data Sources\ External systems accessed during the investigation
• Response Data\ Raw and processed results from each source

Notes Tab

• Reviewer Commentary\ Space for analyst observations and feedback
• Collaboration Space\ Team communication around the investigation

Remediations Tab

• Suggested Actions\ Follow-up steps based on the investigation outcome
• Automation Triggers\ Potential response automations for similar alerts

Changelog Tab

• Investigation Timeline\ Chronological record of investigation events
• System Events\ Automated actions and status changes
• Review History\ Prior review activity and modifications

Standard Approval Process

Investigation Review

• Verify the Conclusion aligns with your SOPs

Approval Execution

• Select Approve and Close to keep the same Conclusion
• The investigation moves to Reviewed

Conclusion Modification Workflow

Investigation Review

• Verify the Conclusion aligns with your SOPs

Change Conclusion State

• Use the dropdowns in the top-right to update the Conclusion:
  • Malicious
  • Suspicious
  • Inconclusive
  • Benign

Document Feedback

• Add notes explaining why the Conclusion was changed
• Adjust pre-set selections as appropriate
• Click Save to move the investigation to Reviewed (unless unchecked)

Onboarding Recommendation

During onboarding, we recommend reviewing 10–15+ investigations per day for the first few weeks, prioritizing:

• Urgent
• Malicious
• Suspicious

This accelerates alignment with your internal SOPs and helps tune Dropzone quickly.

What’s Next?

Once you’re comfortable reviewing investigations, explore our Best Practice guides for:

• Building Custom Strategies
• Setting up Response Actions
• Leveraging Context Memory