For the complete documentation index, see [llms.txt](https://docs.dropzone.ai/llms.txt). This page is also available as [Markdown](https://docs.dropzone.ai/dropzone-101/terms-and-defs/investigations.md).

**Investigations** are the core workflow in Dropzone. They represent the automated analysis of security alerts using the Dropzone AI SOC Analyst, combining alert data, contextual enrichment, and investigative reasoning into a single, reviewable case.

Investigations help security teams move from raw alerts to actionable conclusions quickly and consistently, reducing manual effort while maintaining analyst oversight.

* * *

## What Is an Investigation?

An investigation is created when Dropzone ingests a security alert from a connected alert source. The AI SOC Analyst then:

- Collects relevant data from integrated tools
- Enriches alerts with context and evidence
- Analyzes activity using investigative logic
- Produces a conclusion and supporting findings

Each investigation captures the full lifecycle of this process, from alert ingestion through final review.

* * *

## Investigation Outcomes

Every investigation results in a conclusion that reflects the AI’s assessment of the activity, such as:

- **Malicious** – Confirmed threat or attack
- **Suspicious** – Potentially malicious activity requiring attention
- **Benign** – Legitimate or expected behavior
- **Inconclusive** – Insufficient evidence to determine intent

These conclusions help teams quickly understand risk and prioritize response.

## Key Investigation Components

At a high level, investigations include:

- **Alert context** – Details about the triggering alert
- **Findings** – Key evidence and investigative insights
- **Evidence** – Data pulled from integrated tools
- **Conclusion** – The AI’s assessment of the activity
- **Review state** – Status indicating whether the investigation has been reviewed

Each component is designed to support fast understanding and informed decision-making.

## Prioritization and Workflow

Investigations are organized by priority—such as **Urgent**, **Notable**, or **Informational**—to help teams focus on the most critical work first.

They move through a clear workflow, from creation and analysis to review and closure, enabling scalable operations without sacrificing control.

## Why Investigations Matter

Investigations are the foundation of Dropzone’s value. They:

- Reduce alert fatigue by automating analysis
- Provide consistent, repeatable investigative outcomes
- Preserve transparency through evidence and reasoning
- Enable analysts to focus on high-impact decisions

By combining automation with human review, investigations allow teams to scale security operations while maintaining confidence and accountability.

## What’s Next

This overview introduces what investigations are and how they fit into the platform. For detailed guidance, see our [Best Practices Guide for Reviewing investigations](https://docs.dropzone.ai/best-practices/deep-dive-into-investigation-reviews)