// Investigation
Watchlist
Entities under deliberate observation. The detection engine raises the risk of any finding that touches a watched entity, so watching something changes what the pipeline does rather than merely bookmarking it.
3entities watched
Watched entities
Findings touching these entities are scored 15 points higher.
| Type | Value | Reason | Known risk | Added by | Added | Action |
|---|---|---|---|---|---|---|
| User | jsmith | Credential confirmed compromised in INC intake. Watching pending password rotation and session revocation. | 94 | Analyst | ||
| IP address | 185.100.200.50 | Threat intelligence match, observed in the takeover chain. | 98 | Analyst | ||
| Host | WIN-DC01 | Domain controller. Any anomaly here is treated as high impact. | 88 | Zain Khan |