Investigating an Incident: Timeline and Signals

Investigating an incident: timeline and signals

When you open an incident in Petra, you get a detailed view built around a timeline and a set of signals. This view is the main place where you understand what happened, who was affected, and what to do next. This article explains what you're looking at and how to use it.

The incident detail view

After you click an incident from the incident list, you'll see a page dedicated to that incident. At the top you'll typically see the affected user (identity), the tenant, the incident type or tags, and the current severity and remediation status. From there you can scroll or navigate to the timeline, signals, blast radius (what was accessed or sent), and recommended actions. Having everything in one place lets you piece together the story of the attack or misuse without jumping between multiple tools.

Understanding the timeline

The timeline shows events in chronological order—sign-ins, email access, file access, and other activity that Petra has associated with this incident. You can see when the suspicious activity started, what the user (or attacker) did over time, and when key actions occurred. The timeline helps you answer questions like: "When did they first sign in from the suspicious location?" and "What did they access after that?" Use it to understand the scope and sequence of the incident and to document what you found for your own notes or for reporting.

What signals are

Signals are the behavioral or contextual clues Petra used to flag this incident. For example, you might see signals related to impossible travel (sign-in from two distant locations in a short time), a new or suspicious IP or network, MFA or device changes, or unusual access to emails or files. Each signal is a piece of evidence that, taken together, supports the conclusion that something bad happened. Reading through the signals helps you validate that the incident is a true positive and gives you talking points if you need to explain the finding to the user, their manager, or a customer.

Detection overview and next steps

Many incident views include a detection overview or summary that states in plain language what Petra detected and why it created the incident. Below that you'll often see recommended remediation actions—for example, lock the account, reset the password, or remove a phish from mailboxes. You can take those actions from the incident view (when remediation is enabled for the tenant) and then update the incident's status and add notes as you go. Using the timeline and signals together with the recommended actions helps you go from "something's wrong" to "here's what we did about it" in one place.