Skip to main content

First investigation checklist

Run this once with a small time window to prove every part of the deployment works. It is a checklist; the detail of each screen is on Getting Started.

1. Create

  • From the splash screen press Start investigation. The New investigation form asks for an Investigation Name, a Lookback Period (default 30 days), Known Compromised Accounts, and, when appliance-wide connectors exist, which of them to attach.
  • Community Edition allows two investigations at a time, not counting the two seeded demos. Deleting one frees the slot.
  • Open the investigation. Everything below happens inside it.

2. Add sources

  • Sources > Add Source. Sources are configured per investigation; someone with Change appliance settings (Admin by default) can also keep appliance-wide credentials under Settings > Source Connectors (Professional), and copy an investigation's source into them.
  • Adding and testing a source needs Manage sources. Running and cancelling collection needs Run and cancel collection. IR lead and Admin have both by default. Analyst can view sources and upload evidence; that is all. An admin can change this on the Users and roles page.
  • A greyed tile with Not available yet has no connector built for it. A locked tile needs a higher tier.

3. Test each connection

  • Press Test Connection on every source. The result is a toast: green Connection Successful with the connector's message, or red Connection Failed with the reason.
  • A healthy test marks the source Connected and updates its last-connected time, which the page does not show. Anything else marks it Error with the message kept on the source, and writes no time. Test again after any change.
  • Healthy means the credentials and permissions work for the test call. It does not prove every permission a collection needs; the first collection does.

4. Collect

  • Press Start Collection on a source and choose the time window. Start small: a day, not a quarter.
  • Collections queue one at a time per investigation. A run stops after one hour and the source shows Collection timed out after 1 hour.
  • The progress percentage assumes a fixed total and is an estimate, not a measure of what is left.
  • A run started without an explicit window resumes from the last checkpoint, so a failed run is not repeated from the start. A run with a chosen window collects exactly that window and is not resumed.

5. Read the warnings

Two places show what a run or an upload could not do:

  • Per-source warnings on the Sources page. A source whose last run had warnings shows Last collection finished with N warnings; open them. Typical ones: a host that could not be reached over WinRM; a server name that did not resolve; a domain controller that would not report its time zone; events that had no usable timestamp and were not stored; an alert whose time could not be read.
  • Upload badges. Next to each uploaded file: the event count, a skipped (no timestamp) count, the date-order decision for a CSV, and 0 entries for a log file nothing parsed from. See the CSV date-order rule.

A source that shows Connected with zero events after a collection is not necessarily broken: the window may be empty. Widen it before you look elsewhere.

6. Analyse

  • The Timeline shows the collected events; the Entities tab the users, hosts and indicators. A timeline row that carries an indicator shows its enrichment state (the three states).
  • To record a decision or event that happened outside CICADA, such as a call with the client or legal advice, press Add Entry on Case Activity. Give it a title, details and when it happened. It appears in Case Activity and in every report. Entries cannot be edited or deleted; to correct one, add a new entry. Each entry is part of the investigation's chain of custody, so evidence verification fails if one is changed on disk. Analysts, IR leads and admins can add entries.
  • AI Defender and the LLM Assistant (both in the sidebar) need a configured and approved provider (AI and local LLM).
  • Response actions go through the approval queue, where someone with Approve or deny actions and Execute actions on customer systems (IR lead and Admin by default) reviews, approves and executes them. A low-impact action an analyst creates by hand (Collect Event Logs, Search File Hash) is created already approved, so it proves execution but not approval. To see the approval step, let AI Defender recommend an action, or queue a higher-impact one against a test account, and have the IR lead approve it.

7. Read the report

  • Report generation needs Professional or above. Generate an executive summary or a technical report and check that names, times and sources read correctly.
  • Then, on Professional or above, make a backup (Backups) so the first known-good state is kept.

Next