Closing an Investigation

Closing an investigation records that the case is resolved, freezes the operational view for that item, and keeps the outcome available for audit and later review in the completed list.

​

Overview

You close an investigation when assessment and any required enforcement actions are done, or when the case is dispositioned without further action. The investigation remains in the system as a historical record; it moves off active queues into the Completed tab described in Past Investigations.

​

Resolving an Investigation

Mark the investigation complete from the case actions (including options under the card’s more menu where your deployment exposes them). The UI updates the card’s status and timestamp (for example “Completed | a month ago”). Confirm that the correct investigation ID and subject match before completing, especially when handling similar summaries.

​

Investigation Outcomes

An outcome is the disposition you assign when closing: cleared, escalated and resolved, monitored with no further Enforce steps, or other labels your organization configures. Outcomes should align with internal runbooks so reporting and enforcement status stay consistent across teams.

​

Documentation

Capture justification and notes your process requires—why the case was closed, what was verified, and any links to tickets or HR/legal steps. That context complements the AI-generated description on the Predict card and supports later review of past cases.