Investigations

Incident investigations should be tracked here for confirmed malicious or highly-suspect activities, unlike low-level alert investigation work like false positive clearing - which should remain closer to the tool of origin (such as Elastic Detection Alerts within Elastic Security Cases).