Work through an investigation case

1. Open the Case list and filter by case status if needed. Open the case you want to review.
2. Read Follow the sequence and inspect the retained source evidence, priority explanation and request-evidence links.
3. Use the investigator field to assign an authorized reviewer, or leave it blank to unassign.
4. Add a short investigation note without credentials or unnecessary personal information. Confirm the displayed site and case before saving.
5. Choose the appropriate status and Save case status. Reopening a closed case requires the explicit reopen choice.

A shared local request identifier is stronger context than an address-and-time association. Shared NAT, proxy use and ordinary authorized activity remain alternative explanations for address links.

Priority helps order review. Neither priority nor a related sequence proves malicious intent, fraud or causality. The history retains reviewer notes, assignment and status decisions.

Review Incident rules from the Cases page before relying on case processing. Investigations → Background processing explains the required saved configuration and explicit background-processing choice. An empty list alone does not establish that the site is safe.