Tagged insider-threat-investigations