Investigation Workspace
Investigation workspace concepts for evidence-driven analysis, hypothesis tracking, and analyst accountability.
Investigation Workspace
Industry Problem
Security investigations rarely finish in a single sitting. Analysts switch between vulnerability data, identity context, threat intelligence, tickets, and collaboration tools. Each switch loses layout state, open entities, partial conclusions, and the reasoning chain that connects evidence to decisions.
Without a persistent investigation context, teams duplicate work, contradict earlier conclusions, and struggle to explain why a decision was made weeks later during audit or handoff.
Why the Problem Exists
Enterprise security platforms historically optimized for lists and dashboards, not for long-lived analytical work. SIEM consoles focus on events; vulnerability tools focus on findings; ITSM focuses on tickets. None treats the investigation itself as a durable object that spans tools and time.
Analysts compensate with spreadsheets, notes, screenshots, and tribal knowledge—none of which inherit governance, provenance, or tenant isolation by default.
Traditional Approaches
| Approach | Limitation |
|---|---|
| Ad hoc notes and documents | No provenance; hard to audit |
| Ticket-only workflows | Captures outcome, not reasoning |
| Static dashboards | No session continuity |
| SOAR playbooks | Automate response; rarely preserve analyst reasoning |
| Shared drives / wikis | Outside security governance boundaries |
Mature programs aim for evidence-first investigation: every conclusion traceable to integrated sources, with analyst validation explicit in the workflow.
SentriScope Perspective
SentriScope treats an investigation session as a first-class operational object (implemented). The investigation workspace is the analyst-facing surface where that session lives—not a generic dashboard, and not an autonomous agent.
Core design principles:
- Investigation-first — The session outlives any single page or module visit.
- Analyst in control — Conclusions and governed decisions require human validation.
- Evidence-driven — Findings link to supporting and contradictory evidence; see KID-ARC-0001 for the evidence concept.
- Deterministic intelligence remains authoritative — Risk scores, graph traversal, and enrichment outputs are consumed; the workspace records what the analyst selected and why.
- Tenant-scoped and auditable — All session data respects tenant boundaries and security-relevant actions are logged.
Analytical lineage the platform preserves (conceptually):
Evidence → Hypothesis → Finding → Recommendation draft → Decision → Outcome
The workspace integrates notebook-style analyst knowledge, structured findings and hypotheses, curated evidence packages, bookmarks, timeline position, and navigation history—without replacing the canonical data layer described in global authorities KID-PLT-0001 and KID-PLT-0003.
Current Product Capability
| Capability | State | Summary |
|---|---|---|
| Investigation session persistence | Implemented | Pause and resume investigations with scope and context |
| Workspace layout and navigation state | Implemented | Panels, filters, open entities, cross-module continuity |
| Findings and hypotheses | Implemented | Structured reasoning with severity, confidence, relationships |
| Evidence workspace (curated packages) | Implemented | Analyst-assembled evidence collections with provenance |
| Recommendation drafts from findings | Implemented | Conversion path; does not auto-create governed recommendations |
| Attack graph state within session | Implemented | Supports investigation-oriented path context |
| AI conversation memory (investigation) | Implemented | Assistive; read-only with respect to critical evidence paths |
| Collaboration and replay | Implemented | Multi-analyst collaboration and session replay capabilities |
| Autonomous investigation closure | Not available | Analyst validation required |
For platform-wide maturity qualifiers, see KID-PLT-0004—the sole authority for implemented vs partial vs planned status.
Current Limitations
- SentriScope does not autonomously close investigations or approve decisions without analyst action.
- Investigation depth varies by integrated data sources; empty or stale connectors reduce session value.
- Not every evidence subtype has complete public documentation yet; advanced evidence quality dimensions exist in the product but are not fully described publicly.
- The investigation workspace complements SIEM, SOAR, and ticketing tools—it does not replace them. See KID-PLT-0002.
- Organizational intelligence themes may extend investigation context progressively; not all are generally available.
Common Questions
Is the investigation workspace the same as a SOAR case?
No. The workspace preserves analyst reasoning and evidence within SentriScope's tenant-scoped model. SOAR cases orchestrate response across external tools. Integration may exist; replacement is not the design center.
Does AI run investigations automatically?
No. AI assistance supports analysis workflows and may consume curated evidence packages. It does not replace analyst validation or deterministic scoring paths. See KID-PLT-0002.
What entities can investigations reference?
Investigations operate over canonical concepts—assets, identities, exposures, incidents, threat intelligence, and related entities—defined authoritatively in KID-ARC-0001. This document does not redefine those entities.
Can investigations be reused as organizational knowledge?
Yes (implemented). Sessions are designed to convert investigation outcomes into reusable organizational knowledge over time, subject to tenant governance.
Related Concepts
Prerequisites (authority)
- What is SentriScope? —
KID-PLT-0001 - Platform Overview —
KID-PLT-0003 - Canonical Data Model —
KID-ARC-0001
See also
- Attack Graph Overview —
KID-AGR-0001 - Operational Intelligence —
KID-OIN-0001
Planned (Stream B — education)
KID-CON-0001Evidence-Based InvestigationKID-GLS-0001Investigation sessionKID-GLS-0002Evidence workspace