Skip to main content
The Workbench is where investigation and response happen. When you open an incident from the Command Dashboard, the Workbench gives you everything you need in one view.

​
Workbench Components

Entity Context Graph — Visual map of all entities involved in the incident (users, devices, IPs, files, URLs) and how they’re connected. This is your starting point for understanding the scope and blast radius. Gamebook Panel — Build your response workflow by selecting actions for each entity. Click Run to execute all actions through the IRIS response engine. Timeline — Chronological view of all events, alerts, and actions related to the incident. Evidence — Supporting artifacts, logs, and detection details. Comments — Add investigation notes for your team and audit trail.

​
How to Use the Workbench

  1. Open an incident from the Command Dashboard by clicking on it
  2. Explore the Entity Context Graph — click on entities to see details and available actions
  3. Select response actions per entity in the Gamebook panel
  4. Click Run to execute the Gamebook
  5. Add comments documenting your findings and decisions
  6. Classify and close the incident when complete
The available response actions depend on the entity type and your connected integrations. See Available Actions for the full list.
For the full reference, see Workbench Overview in our platform documentation.