The status word is not a finding

The status is where the case sits

A status such as Investigating, Monitoring, or Closed says which stage the workflow is in. It is a word the case system stores so people know the queue state. It does not describe an activity on a host.

Changing the status updates the queue. It does not attach a log, and it does not record what anyone concluded.

A finding names a source

A finding is a sentence that cites a source: a report, a log line, or a note with a time. Without that citation, you have a status, not a finding.

Do not expand Investigating into a story about what happened. The story has to come from a source you can point at.

How the update reads

File the status as the workflow word. File findings separately, each with its source. If there are no findings yet, write that. A closed status still needs the findings that were actually written, not a new story invented at close.

Lab: Investigating with no cited line

IR-2026-014 is set to Investigating. No log line and no user report is attached. A draft says lab-web-02 was taken over because the status says the team is investigating.

The note says status Investigating and findings none yet. The status is the queue state. No takeover sentence is added. The host is not described beyond whatever a later source actually says.

incident: IR-2026-014
status: Investigating
attached sources: none
write: workflow state only
not: a takeover, and not a finding