---
schema_version: "1"
id: 18665977da8f4ae417a717174fa371a11dd8422389600befa04247508c3c347c
title: Focus Security Investigations with Anomaly Triage (Beta)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_security_agentforce_triage.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_agentforce_triage.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: f75d7750f8022513527d0c94df8d00e9173c77404fa2617b61e3cc4758066553
description: See related security anomalies consolidated into a single investigation. The Security Agent correlates anomalies from the same user session or user activity within 24 hours, creating an investigation only when it identifies a unique threat. This approach reduces alert fatigue and directs your security team to the core incident.
products:
  - Cross Cloud
release: "262"
---
# Focus Security Investigations with Anomaly Triage (Beta)

See related security anomalies consolidated into a single investigation. The Security Agent correlates anomalies from the same user session or user activity within 24 hours, creating an investigation only when it identifies a unique threat. This approach reduces alert fatigue and directs your security team to the core incident.

**Where:** This change applies to Lightning Experience in Enterprise, Performance, Unlimited, and Developer editions with Security Center and Agentforce Platform add-on subscriptions.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-262-0-0-production-enus/e945111b-3e0a-4011-accc-d5949363bfcc/images/icon_note.png)

Note

Security Center with Agentforce is a pilot or beta service that is subject to the Beta Services Terms at [Agreements - Salesforce.com](https://www.salesforce.com/company/legal/agreements/) or a written Unified Pilot Agreement if executed by Customer, and applicable terms in the [Product Terms Directory](https://ptd.salesforce.com/). Use of this pilot or beta service is at the Customer's sole discretion.

**When:** This functionality is available May 11, 2026.

**Who:** This feature is available to customers with a Security Center license and the Agentforce add-on. To get full functionality, customers also need an Event Monitoring license.

**How:** Use the Investigations tab in your Security Center setup to see every new, in progress, and resolved investigation. Click the name of any investigation to see details of the incident and investigation.