Interactive Workbench
Not all tickets include an interactive investigation; it only appears when there is actual operational evidence to examine in the log room.
- Appears in tickets that include real operational logs like SIEM, Endpoint, Firewall, or Cloud logs.
- Does not appear in purely analytical or governance tickets if the evidence is only contextual.
- The timeline and evidence timestamps are based on the actual time within the ticket itself.
- If it doesn't appear, it means the ticket is resolved through the standard view of evidence and decision only.
Use the interactive workbench when you need to trace the event sequence within logs and correlate evidence before making a decision.