Escalate an investigation
Escalate an investigation when you need to work on it with other people, whether to coordinate a broader response or to collaborate privately with a smaller group. An escalation brings related investigations together with their attachments, a summary, and assignees, and you choose who can see it.
You create each escalation yourself; AlertZero doesn't create them for you. When you create one, you become its owner, and only the owner can change its visibility later. Escalating an investigation doesn't close it or change its status, assignees, or contents. When you close the escalation, its linked open investigations close too.
To create an escalation or add an investigation to one, your role needs specific privileges. Refer to Grant access to AlertZero.
To escalate an investigation, select Open an escalation from its actions menu on the Proposed actions page, or from its details flyout. You can change the escalation's title and choose whether it's visible to anyone with the appropriate privileges, or restricted to specific people. If you restrict access, add the people who should work on it. You become its owner and an assignee, and you can change assignees later.
If an investigation belongs to a response that's already escalated, add it to that escalation instead of creating a new one.
Start from the investigation and choose to attach it to an existing escalation. Search the open escalations and select the one for the same response. Each shows how many investigations it already links. Some escalations are unavailable, such as one that already links the investigation. Hover over an unavailable escalation to find out why.
You can add an investigation to a restricted escalation only if you own it or have been given access to it.
- Find the escalation and read its summary.
- Work on the escalation with your team.
- Add or change assignees.
- Close the escalation when the response is complete.