An Investigation includes all suspicious activity (Alerts) related to a specific entity.
When you open an Investigation, you’ll first see a summary section that highlights:
The total number of Alerts within the Investigation.
The Outcomes (e.g., Suspicious or Dismissed) that have been recorded for those Alerts.
Below the summary, you’ll find a list of all open Alerts aggregated for that entity. These Alerts represent ongoing events—such as transactions or login attempts—that meet the criteria defined in your organization’s policy to trigger an Alert. The Alerts are displayed in a timeline view, with the most recent activity shown at the top.
Reviewing an Alert
If you are assigned to review an Alert:
Select Review next to the Alert.
Choose an Outcome — Suspicious or Dismissed.
Enter a Review Reason and add any relevant notes to support your decision.
⚠️ Note: The decision you make applies only to that specific Alert. It does not affect the overall Investigation status.
Reviewing Alerts in Bulk
If multiple Alerts share similar indicators, you can review them together.
Use the Filters (Status, Outcome Reason, Type, or Device ID) to group related Alerts
Select the Alerts with common characteristics.
Perform a Bulk Review to apply the same decision to all selected Alerts.
Alerts that require review will be:
Auto-assigned to the designated reviewer
Manually assigned by a user
Automatically assigned to the agent completing the bulk review.
Escalating an Investigation to Case Review
If an Alert is determined to be Suspicious and further action is needed — such as requesting a manager review or filing a SAR — the agent can promote the Investigation to Case Review status.
Steps to Promote an Investigation:
Assign yourself to the Investigation (or ensure you are already assigned).
In the example below, Agent Jane Zachar is assigned to the Investigation before promotion.Select Promote to Case from the available actions. The Investigation status will update to Case Review.
In the Note section of the Review:
Add a brief description summarizing why the Investigation is being escalated.
Attach any supporting documents as evidence.
4. Escalation details — including the review reason, notes, reviewer, and date — will appear at the top of the Investigation feed.
Closing an Investigation
Once you are assigned to an Investigation, you have the ability to make the final decision to close it.
Before closing an Investigation, ensure that all associated Alerts have been reviewed and marked as either Suspicious or Dismissed. This step is required to complete the Investigation.
⚠️ Important: Once an Investigation is closed, it cannot be reopened. Any future Alerts triggered for the same entity will automatically create a new Investigation.
When closing an Investigation, select one of the following outcomes:
Confirmed Risk – The activity has been verified as a true positive (suspicious behavior confirmed).
Dismissed – The activity was determined to be not suspicious.
After closing, the final decision will appear at the top of the Investigation feed, along with the corresponding notes, reviewer details, and date of closure.
Adding Notes and Evidence to Transactions and Bank Accounts
In addition to notes at the Alert and Investigation level, agents can attach notes and upload documents (as “evidence”) to a specific transaction or bank account from within an Investigation. This keeps context connected to the exact transaction or account it belongs to — useful for documenting findings on refunds, disputes, chargebacks, and account reviews — improving accuracy, audit readiness, and handoffs between agents.
To add a note or document:
Within the Investigation, locate the transaction or bank account.
Open the ellipsis (⋮) menu on the transaction or bank account.
Choose to add a note or upload a document.
Once added:
Notes and documents are shown on the Investigation timeline.
An indicator is displayed on the transaction or bank account header, so other agents can see at a glance that evidence is attached.
Permissions: agents must have permission to view and add evidence to use this functionality, so your organization can control who can attach notes and documents. The permission is configured on the Roles page under Settings.
Notes and documents can also be added to an Investigation programmatically via the Investigations API.
Investigation and Alert Details
Each Investigation contains all related Alerts for a single entity. Because these Alerts provide insight into specific events or behaviors, having context about the entity itself helps agents make more informed review decisions.
When you open an Investigation, you’ll see the Entity Panel on the right side of the screen.
The Entity Panel
The Entity Panel provides a quick, structured summary of key information related to the entity under review. It is divided into several sections:
Profile
Displays a summary of the entity’s personally identifiable information (PII).
Includes two unique identifiers:
Entity Token – Automatically generated by Alloy; begins with “P-” for person-type entities or “B-” for business-type entities.
External ID – Used to map the entity to your organization’s customer records.
Both IDs can be used to search for the entity in the Investigation Queue search bar.
Published Attributes
Shows key attributes associated with the entity that are configured for workflow decisioning.
Examples include Risk Score, Customer Income, or other metrics relevant to your review process.
These attributes give agents important context when evaluating an Investigation.
Accounts
Lists all accounts that Alloy has linked to the entity, providing visibility into related financial or operational connections.
Investigations
Displays a history of past Investigations for the same entity, including:
The number of prior Investigations
Dates when they were opened
Outcomes and resolution details
Accessing the Full Profile
Agents can click directly from the Entity Panel to open the full Entity Profile, where additional data and expanded views of each section are available.
Understanding the Workflow Dropdown
The Workflow dropdown allows reviewers to access deeper insights about the Alert. The information displayed here depends on the Event Type that triggered the Alert (for example, a transaction, login attempt, or account update).
For Transaction Alerts
Transaction-based Alerts typically include:
Transaction Details – such as the amount, merchant category, timestamp, and any associated accounts.
Recent Activity – a list of the entity’s most recent transactions for additional context.
Outcome Reasons and Tags – indicators showing which rule or condition triggered the Alert.
Data Source Responses – results from third-party or internal data checks used during the workflow decisioning process.
Other Data Panel – additional payload data configured by the client to display relevant custom fields.
This contextual data helps reviewers understand why the Alert was generated and assess its potential risk more effectively.
Outcome Reasons and Tags
Outcome Reasons and Tags provide valuable insight into the rules that triggered an Alert.
Agents can click on these fields to view:
The logic or conditions used in the workflow rule.
The specific values that were evaluated during the decision process.
The results that led to the Alert’s creation.
This level of transparency allows reviewers to trace each Alert back to its source logic and determine whether the outcome aligns with the expected behavior.
💡 Tip: From the Alert details view, agents can also view or download transactions and other data tied to the rule logic for further analysis or recordkeeping.