Investigation Failed when trying to reopen a closed alert — VIP/subscription issue or attempt limit?
Hi,
I'm currently working through the LetsDefend SOC Analyst path and I'm having an issue with one of the closed alerts.
I previously had access to the SOC environment and was able to use the investigation/VM features until around August 10. Now, when I try to investigate a closed alert again, I get:
“Investigation Failed — Failed to start investigation.”
I've attached a screenshot of the error.
I'm wondering if this could be related to the number of times a closed alert can be reopened/investigated. Specifically:
- Is there a limit on how many times you can attempt/reopen a closed alert?
- If so, does the third attempt require VIP access?
- Could this error simply be because my account is currently showing as Basic?
- Has anyone else encountered this exact “Investigation Failed — Failed to start investigation” message?
For context, I previously had a VIP Annual subscription showing in my billing portal, so I'm also trying to determine whether this is an account/subscription issue or simply a limitation on investigating closed alerts.
Any clarification would be appreciated. Thanks