﻿---
title: Investigate security events
description: Use Elastic Security investigation tools to triage alerts, trace threats to their root cause, interrogate live hosts, and coordinate your SOC team's incident response.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate
products:
  - Elastic Cloud Serverless
  - Elastic Security
applies_to:
  - Serverless Security projects: Generally available
  - Elastic Stack: Generally available
---

# Investigate security events
When Elastic Security's [detection engine](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/detect-and-alert) creates an alert, you need to understand what happened: the threat's scope, root cause, and impact. Elastic Security provides a range of tools for this purpose, from an interactive event workspace and forensic visualizers to live host interrogation and collaborative case management.
Together, these tools let you move from a single alert to a complete picture of an incident without leaving Kibana. You can correlate events across data sources in [Timeline](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/timeline), trace process execution chains with the [visual event analyzer](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/visual-event-analyzer), inspect running hosts with [Osquery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/osquery), and document findings in [cases](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/security-cases) and [notes](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/notes). [AI chat](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/explore-analyze/ai-features/ai-chat-experiences) can help you interpret alerts, generate queries, and suggest next steps throughout your investigations.

## Where to start


| Your goal                                         | Start here                                                                                                                                                                                                                                                                       |
|---------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Investigate an alert or hunt for threats          | [Timeline](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/timeline)                                                                                                                                                           |
| Trace a process to its root cause                 | [Visual event analyzer](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/visual-event-analyzer)                                                                                                                                 |
| Review a Linux session for suspicious activity    | [Session View](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/session-view)                                                                                                                                                   |
| Audit live host state during an incident          | [Osquery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/osquery) → [Run live queries from alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/run-osquery-from-alerts) |
| Correlate alerts with known threat intelligence   | [Indicators of compromise](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/indicators-of-compromise)                                                                                                                           |
| Track and coordinate an incident across your team | [Cases](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/security-cases)                                                                                                                                                        |
| Identify coordinated attacks across many alerts   | [Attack discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/ai/attack-discovery)                                                                                                                                                    |
| Use AI to accelerate your investigation           | [AI chat](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/explore-analyze/ai-features/ai-chat-experiences)                                                                                                                                                    |


## How investigation tools work together

Investigation typically progresses from initial triage to documented resolution:
1. **Triage the alert.** The detection engine generates an alert. You open it to review the alert details, severity, and affected entities. [Attack discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/ai/attack-discovery) can help you prioritize by identifying coordinated attacks that span multiple alerts.
2. **Explore context in Timeline.** Add the alert to a Timeline and query related events using KQL, EQL, or ES|QL. Correlate data across hosts, users, and network activity to understand the broader event sequence.
3. **Dive into forensic detail.** Use the visual event analyzer to inspect the process tree that led to the alert, or use Session View to review full Linux sessions, including terminal output and user activity.
4. **Interrogate the live environment.** Run Osquery against affected hosts to check running processes, open ports, installed software, and other OS-level context that helps confirm or rule out compromise.
5. **Cross-reference threat intelligence.** Check indicators of compromise to learn whether observed artifacts (IPs, domains, file hashes) match known threats.
6. **Document and collaborate.** Attach your findings to notes on alerts and events, and organize everything in a case. Cases integrate with external ticketing systems like Jira and ServiceNow for cross-team coordination.

[Chatting with AI](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/explore-analyze/ai-features/ai-chat-experiences) can accelerate any stage of this workflow by helping you interpret alert data, generate queries, and suggest next steps.

## Investigation tools


### Timeline

[Timeline](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/timeline) is the central workspace for investigations and threat hunting. You can add alerts from multiple indices, drag fields from tables and histograms across the Elastic Security app, and build complex queries using KQL, EQL, or ES|QL. Use the **Correlation** tab to write EQL sequence queries that reveal ordered attack patterns across event categories, or use the **ES|QL** tab for flexible, pipe-based data exploration.
You can also create [Timeline templates](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/timeline-templates) and attach them to detection rules so alerts automatically open with the right filters.

### Attack discovery

[Attack discovery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/ai/attack-discovery) uses large language models to analyze alerts in your environment and identify threats spanning multiple alerts. Each discovery describes relationships among alerts, maps them to the MITRE ATT&CK matrix, identifies involved users and hosts, and suggests which threat actor might be responsible. Use Attack discovery to reduce alert fatigue, prioritize the incidents that matter most, and shorten your mean time to respond.

### Visual event analyzer

The [visual event analyzer](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/visual-event-analyzer) displays a graphical, process-based timeline of events that preceded an alert and events that followed it. Each node represents a process, and you can expand the tree to examine child processes, associated alerts, and related events. This is particularly useful for understanding lateral movement, privilege escalation, and multi-stage attacks.

### Session View

[Session View](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/session-view) presents Linux process data in a terminal-inspired, tree-like display organized by parentage and execution time. It shows interactive and non-interactive processes, user information (including privilege escalation), process and network alerts in context, and captured terminal output.

### Osquery

[Osquery](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/osquery) lets you query operating systems like a database using SQL. Run live queries against one or more hosts to inspect processes, files, network connections, installed packages, and hundreds of other OS-level attributes. You can also schedule query packs to capture changes over time, save queries to build a reusable library, and [run live queries directly from alerts](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/run-osquery-from-alerts) or [investigation guides](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/run-osquery-from-investigation-guides) to streamline triage.

### Indicators of compromise

The [Indicators](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/indicators-of-compromise) page collects data from your enabled threat intelligence feeds and provides a centralized view of indicators of compromise (IoCs). Use it to search, filter, and examine indicator details, then cross-reference them with your investigation data. Indicators integrate with [indicator match rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/detect-and-alert/indicator-match) in the detection engine to automatically surface alerts when known threats appear in your environment.

### Cases

[Cases](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/security-cases) let you track incidents, attach alerts and events, document findings, and collaborate with your SOC team in one place. You can link Timelines to preserve investigation context, attach threat intelligence indicators, and view metrics that summarize alert scope and response times. Cases integrate with Jira, ServiceNow, and IBM Resilient so you can escalate and track incidents across your security workflow.

### Notes

[Notes](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/investigate/notes) let you attach written findings to individual alerts, events, and Timelines. Use notes to document what you've observed, coordinate with other analysts, and build a record of investigative reasoning that persists alongside your data. You can manage all notes from the Notes page, where you can search, filter, and review notes across your investigations.

## Related capabilities

Several other Elastic Security features complement these investigation tools:
- [AI chat](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/explore-analyze/ai-features/ai-chat-experiences) helps you interpret alerts, generate queries, and get contextual guidance throughout your investigation.
- [Entity analytics](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/advanced-entity-analytics) provides risk scores and behavioral anomaly detection for hosts, users, and services, giving you additional context when evaluating the significance of an alert.
- [ES|QL for security](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/5592/solutions/security/esql-for-security) describes how to use the Elasticsearch Query Language across the Elastic Security app, including in Timeline.