Escalate an investigation

Escalate an investigation when you need to work on it with other people, whether to coordinate a broader response or to collaborate privately with a smaller group. An escalation brings related investigations together with their attachments, a summary, and assignees, and you choose who can see it.

You create each escalation yourself; AlertZero doesn't create them for you. When you create one, you become its owner, and only the owner can change its visibility later. Escalating an investigation doesn't close it or change its status, assignees, or contents. When you close the escalation, its linked open investigations close too.

Requirements

To create an escalation or add an investigation to one, your role needs specific privileges. Refer to AlertZero privileges.

  1. Start from the investigation that you want to escalate:
    • On the Proposed actions page, find the investigation, select the actions menu , then select Open an escalation.
    • If you already have the investigation open, select Open an escalation at the bottom of its details flyout.
  2. In the Escalate investigation window, keep Create escalation selected.
  3. (Optional) Edit the escalation title. It starts as the title of the investigation.
  4. Choose who can see the escalation:
    • Public: Any user with the Agent Builder: Read or Agent Builder: All privilege can see it. This is the default. You're its only assignee until you add more.
    • Private: Only you and the people you add under Who has access can see it. You're listed as the owner and added as an assignee. Search for users and select any others you want to work with.
  5. Select Open escalation.

Link an investigation to an escalation that already exists when it belongs to the same response. The escalation then covers both.

  1. On the Proposed actions page, find the investigation, select the actions menu , then select Attach to an escalation.

    If you opened the investigation details flyout instead, select Open an escalation at the bottom of the flyout, and then select Add to existing in the Escalate investigation window.

  2. Search for the escalation. The list shows open escalations, and each one shows how many investigations it links. An escalation is unavailable if the investigation is already linked to it, or if you don't own it and weren't added to it as a member of a private escalation. Hover over an unavailable escalation to see why.

  3. Select the escalation, and then select Add to escalation.