Investigation Structure

An Investigation contains all ongoing monitoring activity related to a specific entity. It brings together every stage of the Alert lifecycle — from initial detection through escalation and closure — in one centralized view.

Within each Investigation, you’ll also find Alerts, which represent individual events and their associated risk indicators (for example, a single transaction or a customer login attempt).

Investigation Lifecycle Overview

An Investigation can move through several stages depending on the outcome of each review:

Alert = Alert Review

• Represents individual events and their associated risk indicators (for example, a single transaction or a customer login attempt).

• When an Investigation is in Alert Review status, it means a potential issue has been detected.

• The assigned agent reviews the Alert to determine whether it should be dismissed or escalated.

Case = Case Review

• If an Alert appears suspicious or requires deeper analysis, the Investigation can be promoted to Case Review.

• At this point, it becomes a Case, prompting more thorough investigation and documentation.

• This step may also involve collaboration or management review.

Confirmed Risk

• If the Case is confirmed to involve high-risk or suspicious activity, it is marked as Confirmed Risk (a true positive).

• Depending on your organization’s internal policies, these confirmed cases may lead to a Suspicious Activity Report (SAR).

• A separate guide detailing the SAR filing process should be referenced 

Dismissed

• An Investigation or Alert that is determined to be not suspicious is marked as Dismissed.

• Alloy automatically tracks whether the dismissal occurred during Alert Review or Case Review for reporting and audit purposes.