01
Investigate with evidence
Use Case Management to connect ownership, incident status, evidence inclusion and exclusion decisions with an Incident Timeline.
WERANA / Services
Investigation & work records
Gather evidence. Record decisions.Review response outcomes.
Manage incident ownership, decisions, and status history. Review execution responses separately from subsequent observations.
Review workflow
Connect investigation, approval, and follow-up.
Record who decided what, the evidence behind the decision, and the response that followed.
- 01Incident evidence
- 02Review & approval
- 03Execution & follow-up
02
Respond within approved scope
Use an approval workflow to review supported Incident Response actions: process termination, traffic blocking and network isolation.
03
Separate execution from outcomes
Keep execution receipts separate from follow-up observations to document response history and outstanding checks.
Environment & coverage
What can you review in your environment?
Review the applicable scope based on your assets, collection permissions, and existing security operations.
Security categories to compareEDR · NDR · XDR · SIEM · SOAR · DFIR
Investigation & work records
Execution is limited to supported response actions, authorized roles, and approval conditions.
What to discuss
- Incident ownership, roles, and approvals
- Supported response actions and targets
- Follow-up observation and service-health coverage
FAQ
Frequently asked questions
Does command success mean the threat is resolved?
Review the execution response, subsequent observations, and service state separately before deciding what remains to be checked.
How should we compare EDR, NDR, XDR, SIEM and SOAR?
EDR and NDR focus on endpoint and network detection and response; XDR connects security domains; SIEM manages security information and events; and SOAR integrates tools and automates response workflows. Compare this service's evidence, ownership, approvals, response commands and follow-up observations. Confirm third-party integrations and playbook coverage separately.
Does incident investigation include a complete DFIR toolset?
DFIR combines digital forensics and incident response. Managing evidence and timelines is separate from providing memory or disk imaging and a complete forensic analysis toolset. Review supported evidence, response commands, collection, retention and approval conditions.
Start with the scope that fits your environment.
Tell us about your environment and security priorities. We will help review supported capabilities and collection requirements.