> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/modules/detect-and-respond-mdr/self-hosted-soc/phase-2-investigation-core-loop.md). # Phase 2: Investigation: Core Loop {% hint style="info" %} #### Iterative Phase This is the heart of Detect and Respond. Everything in Phase 2 is artefact-driven, timeline-first, continuously documented, and platform-enforced. This loop continues unitl analytical confidence is achieved. You may cycle through Steps 1 to 6 multiple times before reaching a conclusion. {% endhint %} ## Step 1: Review Initial Artefacts When you open a case, review all automatically-added artefacts in the Artefacts panel on the right side of the case view. These may include user accounts, IP addresses, external URLs, files, and hashes.

For each artefact, open the detail view and apply an initial assessment using the Assessment control:

Assessment	When to Use
Benign	Activity is normal and expected. No threat present.
Suspicious	Activity is unusual or unexpected. Further investigation required.
Malicious	Activity is confirmed malicious or a direct indicator of compromise.
Not assessed	Not yet assessed by an analyst

{% hint style="info" %} Where detection logic has provided an intial assessment, review it and confirm or override as approriate. Remember: the initial artefacts reflect what the detection rule matched on. They are a starting point #### Minimum Requirements / Gate * Every artefact must be assessed before the case can be resolved {% endhint %} ## Step 2: Investigation starts - (Investigate SIEM) Click the Investigate button at the top of the case to pivot into the SIEM. Query logs and events to build context not present in the original alert. You should be able to view all logs from your connectors in here without pivoting to each individual tool.

You can write queries directly in syntax, or click the stars next to the search bar to have AI perform a free text search. There are two different types of AI search, Quick Search and Reasoned Search - click their names to switch between the two. Quick search is fast, reasoned search is slower, but overall more accurate. Click the stars again to convert your search back to syntax. All events are normalised to OCSF format, so use this to structure your syntax searches. Typical investigation queries include authentication activity, conditional access changes, policy modifications, and session behaviour. Results can be viewed as an event list or grouped and visualised as time charts and pie charts to help spot anomalies across large data sets.

{% hint style="info" %} #### Tip: Using Quick Search to Learn Syntax Quick Search and Reasoned Search includes an AI-assisted mode. You can type what you are looking for in plain English and the platform will run the query. If you then toggle off the AI mode, it will show you equivalent syntax query it ran. This is a useful way to build your query-writing skills over time. Use it to understand how the platform translates your intent into structured searches, and gradually start writing syntax directly as your confidence grows. {% endhint %} ## Step 3: Expanded Artefacts As you investigate, extract new evidence from logs and action as needed. When hovering over data within an event, you are presented with a number of options: * The plus icon - this adds the value to your search query * The minus icon - Excludes any events with that value for that property * The copy icon - copies the data * The data ingestion icon - this adds the data you have selected to the timeline for the investigation

All evidence relied upon in your conclusions exist as artefacts in the case.

#### Artefact Enrichment When you add IP addresses, URLs, or file hashes, the platform enriches them automatically with threat intelligence data including geolocation, threat verdicts, and known TTPs. This enrichment happens in the background and the results appear directly on the artefact. {% hint style="info" %} #### Minimum Requirements / Gate * All evidence relied upon in your conclusion must exist as artefacts in the case * Mental or undocumented evidence is not permitted. If you used it, it must be in the case {% endhint %} ## Step 4: Assess Artefacts (Continuous) Continuously update artefact assessments as your understanding evolves. This is not a one-time action. Reassess artefacts whenever new evidence changes the picture. Use the Assessment control on each artefact to assign Benign, Suspicious, or Malicious.

## Step 5: Category, Subcategory and MITRE Mapping Classification must be kept current throughout the investigation. Update Category, Subcategory and MITRE ATT\&CK mappings continuously as your understanding evolves. The MITRE ATT\&CK section appears in the Incident Overview panel. Click "Manage MTRE ATT\&CK" to add or update tactics and techniques.

{% hint style="info" %} #### MITRE Auto-Population: What it Means When a case is created, MITRE tactics and techniques may already be pre-populated. These come from the detection rules that fired to generate the incident. They reflect what the platform matched on, not necessarily the full scope of the attack. Always review the pre-populated MITRE data. Add techniques your investigation reveals. Remove anything that turns out not to apply. The mapping should reflect you analytical conclusion, not just the intial detection signal. {% endhint %}

Field	Mandatory?	Notes
Category	Yes, all cases	Must be set before resolution
Subcategory	Yes, all cases	Must be set before resolution
MITRE Tactics	Where applicable	Not required for config changes or false positives
MITRE Techniques	Where applicable	Refine and expand throughout, not a one-time action

## Step 6: Comments and Internal Notes: Continuous Documentation Documentation is continuous, not retrospective. Add notes throughout the investigation. Use the Timeline tab to track all activity chronologically. #### Internal Notes: Investigation and Workflow Records Use Internal Notes for all investigation workings: findings, queries run, hypotheses tested, and workflow justifications. Internal notes are visible to users with access to the ticket case management system only and do not trigger notifications.

#### Comments: Notification Triggers Use Comments when you need to communicate with stakeholders, to request action or provide an update. Comments appear in the incident page, trigger a notification to selected users, and automatically transition the case to Pending until there is a response. Write comments in plain language, as if explaining the situation to someone without a security background. {% columns %} {% column %}

{% endcolumn %} {% column valign="middle" %} {% hint style="info" %} #### Status Automation: Pending When you add a Comment, the case status automatically transitions: Processing to Pending. When there is a response, the platform automatically transitions back to Processing. Do not manually change status to simulate this. #### Design Rule The timeline is the investigation. Internal notes and comments are the working record. The Description field is reserved for the final outcome summary. Do not use it for live investigation notes. {% endhint %} {% endcolumn %} {% endcolumns %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cybaops.com/modules/detect-and-respond-mdr/self-hosted-soc/phase-2-investigation-core-loop.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.