Record a fact
Enter what is true, who or what it is about, and its kind: a person, supplier, domain, application, account, or policy.
Context Hub
Give your security agents
business context.
Keep the people, suppliers, applications, and business requirements that matter to an investigation in one place. Your team reviews what is known, answers open questions, and withdraws information that no longer applies.
Your organization’s contextExample context records
Needs confirmation
Does Finance own this application for invoice processing?About this application · Access review
Awaiting an authorized answerApproved by your team
Your finance lead approves supplier paymentsAbout payment approvals · Confirmed by Finance
Business responsibilityObserved only
Finance often processes payments on FridaysObserved pattern · Not an approved business rule
Needs interpretationDue for review
This supplier is approved by your organizationApproved by your team · Review date has passed
Check that it still appliesOne investigation, one missing answer
An unfamiliar application.
A question your logs cannot answer.
An unfamiliar application may have permission to read mail across your organization, even when its business owner is unknown.
Confirming its owner and business purpose helps your team assess whether that access is appropriate.
How context changes the next questionApplication access example
01 / EVIDENCEBroad mailbox-read permissions
WHAT THIS TELLS USThe app has access.
This alone does not prove mailbox use or compromise.
02 / MISSING CONTEXTNo approved business owner
FOCUSED QUESTIONDoes Finance own this application for invoice processing?
An authorized person can confirm or deny this proposition.
03 / TEAM CONFIRMATIONYes, Finance owns it for invoice processing.
NEXT INVESTIGATIVE QUESTIONDoes the access fit the purpose?
Ownership is established. Permission scope still needs review.
For administrators and authorized teams
Review what Mesa knows.
Add what your team knows.
Keep useful business knowledge inspectable as people, suppliers, and applications change.
Check its authority
Filter records, inspect who established a fact, and look for open questions or information due for review.
Resolve a question
Confirm or deny a specific proposition when you have the knowledge and permission to answer it.
Retire stale information
Withdraw an approved fact or policy when it no longer applies. Add the current information for future review.
A fact you can inspect
Keep the statement connected to its subject and the person who established it.
Illustrative record after confirmation- Statement
- Finance owns this application for invoice processing
- About
- Invoice-processing application
- Authority
- Approved by your team
- Established by
- Authorized Finance administrator
Business context in a security investigation
Different evidence.
Useful business questions.
Examples of the context your team may need when investigating a domain, an identity, or an email.
Takedown
Owned domains, represented brands, and legitimate suppliers.
Is this impersonation, or abuse of a legitimate service?
Identity TDR
Application owners, account responsibilities, and critical accounts.
Who can explain this access, and why does it matter?
Email TDR
Supplier relationships, payment approvers, and expected workflows.
Is this request consistent with the business relationship?
A pattern is not an approved exception.Keep observed behavior separate from the facts your team has confirmed.
Keep facts, observations, and claims distinct.
A relationship or responsibility confirmed by an authorized person.
“This supplier is approved by your organization.”
Account or application details reported by your connected systems.
“The directory reports this account as disabled.”
Business requirements your team records for an investigation.
“Emergency accounts require separate approval.”
A pattern that has not been confirmed as a business rule.
“Finance often processes payments on Fridays.”
An unresolved question linked to an investigation.
“Did your team approve this application?”
A claim from suspicious content, kept separate from approved facts.
“We are your new payment contact.”
Keep approval separate from investigation.
A fact or written policy in Context Hub does not itself authorize an action. Response permissions, policy checks, and approvals remain separate.
01 / INVESTIGATE
Combine evidence with relevant context and identify missing answers.
02 / AUTHORIZE
Check what needs to change, who has access, and whose approval is required.
03 / EXECUTE
Carry out the approved action and track its progress.
04 / VERIFY
Check whether the action completed and what still needs attention.
Using Context Hub.
Do we need to document our whole business first?
No. Start with what matters to the investigation: application owners, approved suppliers and domains, payment approvers, or critical accounts. Add more as useful questions arise.
Who can add or confirm information?
Team members with permission to write organizational context can add facts, confirm or deny questions, and withdraw approved facts or policies. Access follows your organization’s Mesa permissions.
Where is our organizational context stored?
Context is stored in Mesa’s application data store, scoped to your organization. See our privacy policy and trust center for data-handling information.
Can Mesa ask us for missing information?
An investigation can raise a focused question in Context Hub. An authorized team member can confirm or deny the proposed fact, such as “Does Finance own this application for invoice processing?” The answer supplies business knowledge that security logs may not contain.
What if nobody answers a question?
An unanswered question remains unresolved. Treat the missing information as unknown when reviewing the investigation; a question is not an approved fact.
How do we correct information?
Review the statement, its authority, and its attribution. Withdraw an approved fact or policy that no longer applies, then add the current information. A due-for-review flag highlights records whose review date has passed.
Does confirming an app or supplier make all its activity safe?
No. Confirmation establishes a particular relationship or purpose. The investigation still needs to assess the activity and access in question. Knowing an app’s owner does not approve every permission it holds.
Does adding a policy give an agent permission to act?
No. Context helps explain the business requirements. Takedown and identity actions require their own permissions and approval; email remediation follows your configured policy and plan.
How do we get access to Context Hub?
Open Mesa to review the capabilities available to your organization. Contact our team to discuss Context Hub access with your investigation workflow and plan.
Start with the knowledge your next investigation needs.
Add a fact. Review a question. Keep your team’s context current.