Spotlighted Investigations (Benign)

Spotlighted investigations (benign)

Sometimes your team investigates an incident or an event and concludes that it wasn't a real threat—it was a false positive, a test, or an authorized action. Petra lets you mark those as "spotlighted investigations" (or similar) and treat them as benign. That keeps your incident list focused on real work while still preserving a record of what was reviewed. This article explains what spotlighted investigations are and when to use them.

What spotlighted investigations are

Spotlighted investigations are investigations or incidents that your team has explicitly marked as not being a true threat. For example, you might have opened an incident, looked at the timeline and signals, and determined it was a pen test, a known safe behavior, or a misclassification. Instead of leaving it in the main incident list as "remediated" or "incorrect," you can spotlight it so it appears in a dedicated area. That area is for "we looked, it's benign" so that analysts don't waste time re-triaging the same item and so you have a clear separation between "needs action" and "already reviewed and cleared."

Where you'll see them

In the reporting hub there is usually a tab or section for spotlighted investigations (sometimes labeled "Spotlighted investigations (benign)" or "Notes"). There you'll see the list of items your team has marked as benign. You can open any of them to see the original incident or event and any notes that were added when it was spotlighted. That way you retain context for audits or for explaining to a customer why something was closed without action.

When to use them

Use spotlighted investigations whenever you've fully reviewed something and concluded it's not a threat. Marking it as spotlighted/benign keeps your main incident queue clean and tells the rest of the team that no further action is needed. It also helps with reporting: you can show how many items were reviewed and closed as benign, which supports your triage process and reduces confusion about what's still open versus what's been cleared.