Investigations

Investigations in Tamandua Sentinel provide a structured workspace for threat hunting, incident response, and forensic analysis. This guide covers creating investigations, using timeline and process tree views, analyzing network and file activity, and managing investigation artifacts.

Accessing Investigations

Navigate to Investigations in the left navigation panel.

[Screenshot: Investigations list page with active and closed investigations]

Investigation List

List Columns

Filtering Investigations

[Screenshot: Investigation filters with status and priority selected]

Create Investigation

From Alert

1. Open alert details
2. Click Create Investigation
3. Investigation is created with:

• Alert linked automatically
• Agent added to scope
• Title derived from alert

1. Customize details as needed

From Scratch

1. Click New Investigation in toolbar
2. Complete investigation details:

1. Add initial scope:

• Agents: Endpoints to investigate
• Time Range: Period of interest
• Alerts: Related alerts

1. Click Create

[Screenshot: New investigation form with all fields]

From Threat Hunt

1. Execute threat hunt query
2. Review results
3. Click Create Investigation from Results
4. Matching events and agents added automatically

Investigation Templates

Use templates for common investigation types:

Investigation Workspace

The investigation workspace provides a dedicated environment for analysis.

[Screenshot: Investigation workspace with all panels visible]

Workspace Layout

Workspace Sections

• Overview: Investigation summary and key metrics
• Timeline: Chronological event view
• Process Tree: Process hierarchy analysis
• Network: Connection analysis
• Files: File activity and artifacts
• Alerts: Linked alerts
• Notes: Investigation documentation
• Artifacts: Collected evidence

Timeline View

The timeline provides chronological visibility into all events across investigation scope.

Timeline Display

|-----------------------------------------------------|
| 14:30  14:32  14:34  14:36  14:38  14:40  14:42     |
|-----------------------------------------------------|
|   |      |      |      |      |      |              |
|   |      +--[File]---------+                        |
|   |      |                 |                        |
|   +--[Process]-------------+--[Network]             |
|          |                    |                     |
|          +--[Registry]        +--[DNS]              |
|-----------------------------------------------------|

[Screenshot: Timeline view with multiple event types displayed]

Event Types

Timeline Controls

Event Filtering

Filter timeline by:

• Event Type: Process, File, Network, etc.
• Agent: Specific endpoint
• User: Activity by user
• Severity: Alert severity
• Search: Text search in events

Timeline Annotations

Add notes to significant events:

1. Click event on timeline
2. Click Add Annotation
3. Enter note text
4. Click Save

Annotations appear as markers on timeline.

Export Timeline

1. Configure visible time range
2. Click Export Timeline
3. Select format:

• HTML: Interactive report
• PNG: Timeline image
• CSV: Raw event data

1. Click Export

Process Tree

The process tree visualizes process execution hierarchy across investigation scope.

Tree Display

System
└── services.exe
    └── svchost.exe
        └── WmiPrvSE.exe
            └── powershell.exe          [SUSPICIOUS]
                ├── cmd.exe
                │   └── whoami.exe
                ├── net.exe
                └── certutil.exe         [ALERT]
                    └── rundll32.exe     [ALERT]

[Screenshot: Process tree with highlighted suspicious processes]

Tree Node Information

Each node displays:

Tree Navigation

• Expand/Collapse: Click arrow next to process
• Select: Click process to view details
• Focus: Double-click to center and expand
• Search: Find process by name or PID

Process Details Panel

Click a process to view:

[Screenshot: Process details panel with all tabs]

Tree Analysis Features

Highlight Paths

Highlight specific execution paths:

1. Select process
2. Click Highlight Path to Root
3. Full ancestry displayed

Compare Trees

Compare process trees across agents:

1. Select multiple agents in scope
2. Enable Compare View
3. Identical processes grouped
4. Unique processes highlighted

Detect Anomalies

Automatic anomaly detection:

• Unusual Parent: Process with unexpected parent
• Rare Process: Infrequent process in environment
• Execution Flags: Suspicious execution patterns

Anomalies marked with visual indicators.

Network Connections

Analyze network activity within investigation scope.

Connection List

[Screenshot: Network connections list with filters]

Connection Map

Visual network topology:

    [Internal Network]
          |
    [WORKSTATION-042]
          |
    +-----+-----+
    |           |
[192.168.1.100] [malicious.com]
    (normal)        (C2 server)

[Screenshot: Network connection map visualization]

Threat Intelligence Integration

Automatic enrichment with threat intelligence:

Network Filtering

Filter connections by:

• Direction: Inbound, Outbound
• Protocol: TCP, UDP, ICMP
• Classification: Malicious, Suspicious, Benign
• Process: Specific process
• Port: Port number or range

Export Network Data

Export for external analysis:

• PCAP: If packet capture enabled
• CSV: Connection list
• Graph: Network topology

File Activity

Analyze file operations within investigation scope.

File Event List

[Screenshot: File activity list with operation filters]

File Details

Click file to view:

File Operations Visualization

[document.docx]
    |
    +-- 14:32:01  CREATED   by winword.exe
    +-- 14:32:45  MODIFIED  by winword.exe
    +-- 14:35:00  READ      by powershell.exe  [SUSPICIOUS]
    +-- 14:35:02  COPIED    to C:\temp\
    +-- 14:36:00  DELETED   by cmd.exe

Artifact Collection

Collect files for analysis:

1. Select file event
2. Click Collect File
3. File retrieved from endpoint (if available)
4. Added to investigation artifacts

File Filtering

Filter file activity by:

• Operation: Create, Modify, Delete, etc.
• Path: Contains, starts with, regex
• Extension: File type
• Process: Performing process
• Classification: Based on threat intel

Add Notes and Artifacts

Investigation Notes

Document findings throughout investigation.

Adding Notes

1. Click Notes in navigation
2. Click Add Note
3. Enter note content (Markdown supported)
4. Optionally tag other team members
5. Click Save

[Screenshot: Notes section with formatted note entries]

Note Format

## Initial Analysis - 2024-01-15 14:45

### Observations
- PowerShell spawned from Excel (unusual parent)
- Base64-encoded command observed
- Network connection to known C2 IP

### Hypothesis
Likely macro-based malware delivery via phishing

### Next Steps
- [ ] Collect Excel document
- [ ] Analyze PowerShell payload
- [ ] Check other recipients

@analyst2 - Please review process tree

Note Features

• Markdown: Full formatting support
• Mentions: Tag team members with @username
• Checklists: Track action items
• Attachments: Link to artifacts
• Timestamps: Automatic timestamping

Investigation Artifacts

Collect and manage evidence.

Artifact Types

Adding Artifacts

1. Click Artifacts in navigation
2. Click Add Artifact
3. Select artifact type
4. Upload or link artifact
5. Add description and tags
6. Click Save

[Screenshot: Artifact management panel with uploaded files]

Artifact Actions

IOC Management

Extract and track indicators:

1. Click IOCs in artifacts
2. Add IOC manually or extract from events
3. IOC types supported:

• File hash (MD5, SHA1, SHA256)
• IP address
• Domain
• URL
• Email address
• File path pattern

1. IOCs auto-search across telemetry

Investigation Status and Workflow

Status Transitions

    Open
      |
      v
  In Progress  (Active investigation)
      |
      +-------+--------+
      |                |
      v                v
   Closed          Escalated
   (Resolved)      (Incident Response)

Update Status

1. Click Status dropdown in header
2. Select new status
3. Add status note (required for closure)
4. Click Update

Investigation Summary

Close investigation with summary:

1. Set status to Closed
2. Complete closure form:

• Outcome: Confirmed threat, false positive, inconclusive
• Summary: Executive summary
• Root Cause: If determined
• Actions Taken: Response actions
• Recommendations: Follow-up recommendations

1. Click Close Investigation

[Screenshot: Investigation closure form with all fields]

Investigation Metrics

Track investigation performance:

Collaboration

Team Assignment

1. Click Team in investigation header
2. Add team members
3. Assign roles:

• Lead: Primary investigator
• Analyst: Supporting analyst
• Observer: Read-only access

1. Click Save

Activity Feed

Real-time activity stream:

[14:45:32] analyst@corp.com added note "Initial Analysis"
[14:44:10] admin@corp.com collected file malware.exe
[14:42:55] analyst@corp.com isolated host WORKSTATION-042
[14:40:00] analyst@corp.com created investigation

Comments

Discuss specific items:

1. Select event, artifact, or note
2. Click Comment
3. Enter comment
4. Click Post

Team members notified of new comments.

Export and Reporting

Investigation Report

Generate formal investigation report:

1. Click Generate Report in toolbar
2. Select report template:

• Executive Summary: High-level overview
• Technical Report: Detailed findings
• Incident Report: Formal incident documentation

1. Configure sections to include
2. Click Generate

[Screenshot: Report generation options with template selection]

Report Contents

Export Formats

• PDF: Formatted report
• HTML: Interactive web report
• Markdown: Source for documentation
• JSON: Structured data export

Next Steps

• Live Response - Execute commands during investigation
• Alert Management - Link alerts to investigations
• Agent Management - Manage endpoints in scope
• Dashboard Guide - Monitor investigation metrics