---
title: Investigation tools
description: The following are tools for investigating security events and tracking security issues directly in the Elastic Security app. Cases: Track investigation...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4595/solutions/security/investigate
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available in 9.0+
---

# Investigation tools
The following are tools for investigating security events and tracking security issues directly in the Elastic Security app.
- [**Cases**](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4595/solutions/security/investigate/cases): Track investigation details about security issues.
- [**Timelines**](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4595/solutions/security/investigate/timeline): Workspace for investigations and threat hunting.
- [**Osquery**](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4595/solutions/security/investigate/osquery): Run live and scheduled queries on operating systems.
- [**Intelligence**](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4595/troubleshoot/security/indicators-of-compromise): Indicators of compromise used for threat intelligence.
- [**Notes**](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/4595/solutions/security/investigate/notes): Use notes to coordinate responses, conduct threat hunting, and share investigative findings.