Combined case view
Incidents and CVE tickets in one investigations dashboard.
Platform · Investigations
Track every case from open to resolved
Combined incident and CVE investigations with status breakdowns, action metrics, and trends — response intelligence your GRC and SOC teams can report on.
You're on the list. We'll reach out about enterprise access.
Preview
Investigations in BreachQuery
Features
What Investigations delivers
Status breakdown
Open, Triaged, Mitigating, False positive, and Resolved counts with share percentages.
Action metrics
See how many cases need triage versus how much of the backlog is actioned.
Cases over time
Chart incident and CVE volume to spot spikes and measure response velocity.
Deep links to queues
Jump from a status row directly into filtered Incidents or CVEs views.
Audit-friendly states
Every status change is tied to a case your team can reference in reviews.
How it works
Three steps on Investigations
Cases accumulate
New incidents and CVEs enter the open queue from monitoring pulls.
Team triages
Analysts move cases through workflow states as they investigate and remediate.
Leadership reports
Investigations metrics show backlog, action rate, and closure trends.
Use cases
Built for enterprise teams
GRC & compliance
Demonstrate structured response with status counts and closure rates.
SOC management
Track analyst progress and identify bottlenecks in open vs. resolved cases.
Quarterly reviews
Export metrics for board and risk committee reporting.
Cross-team handoffs
Hand CVE cases to infrastructure and credential cases to identity teams with clear status.
FAQ
Common questions
What's the difference from Incidents?
- Investigations is the metrics layer — Incidents and CVEs are the actionable queues.
Are CVEs tracked separately?
- Yes — CVE cases have their own breakdown alongside incident cases.
What counts as action taken?
- Any case moved out of Open — triaged, mitigating, false positive, or resolved.
Can I filter by domain?
- Use domain selectors on Incidents and CVEs; Investigations reflects your full scoped fleet.
Request enterprise early access
Join the waitlist — be first to run Investigations for your organization.