Skip to main content
Past investigations are closed cases listed under the Completed tab. They preserve who was involved, threat context, and collaboration history without cluttering active work queues.

​
Overview

After you close an investigation, it no longer appears under In Progress or Pending for operational triage. Completed cards retain investigation IDs, subject names, threat badges, and summaries so you can verify outcomes and support audits. For how open cases are structured, see Investigations.

​
The Completed Tab

The tab bar still shows counts for In Progress and Pending (for example “In Progress (0)”, “Pending (3)”) so you can see backlog at a glance while browsing history. Selecting Completed lists resolved investigations only.
Enforce Completed
Cards may show multiple avatars when several people collaborated on the same case. Subject names and threat types match the conventions used on open investigations.

​
Reviewing Past Cases

Use completed cards to confirm how similar threats were handled, which enforcement actions were taken, and who participated. Search or filter behavior depends on your deployment; the list itself is ordered for recent closure by default in typical configurations.

​
Investigation History

History is the sequence of status changes, assignments, and outcomes tied to each investigation ID. Together with notes from closing, it forms the audit trail for Enforce. Cross-reference IDs when correlating with Predict or external ticketing systems.