diff --git a/src/data/AuditLogTemplates.json b/src/data/AuditLogTemplates.json
index efa21ac67a53..1762fb2eb7bb 100644
--- a/src/data/AuditLogTemplates.json
+++ b/src/data/AuditLogTemplates.json
@@ -446,6 +446,11 @@
             "value": "[]",
             "label": "[]"
           }
+        },
+        {
+          "Property": { "value": "String", "label": "SecuredAccessPassData" },
+          "Operator": { "value": "like", "label": "Like" },
+          "Input": { "value": "*" }
         }
       ]
     }
diff --git a/src/pages/tools/custom-tests/add.jsx b/src/pages/tools/custom-tests/add.jsx
index b101c5869550..41b01afdd9ea 100644
--- a/src/pages/tools/custom-tests/add.jsx
+++ b/src/pages/tools/custom-tests/add.jsx
@@ -311,6 +311,7 @@ const Page = () => {
     { value: 'Auto', label: 'Auto' },
     { value: 'AlwaysPass', label: 'Always Pass' },
     { value: 'AlwaysInfo', label: 'Always Info' },
+    { value: 'AlwaysInvestigate', label: 'Always Investigate' },
   ]
 
   const scriptNameField = {
@@ -739,7 +740,8 @@ All UPNs: {{join(Result[*].UserPrincipalName, ", ")}}`,
                   </Typography>
                   <Typography variant="body2" color="text.secondary">
                     Return a hashtable with <code>CIPPStatus</code> (<code>Passed</code>/
-                    <code>Failed</code>/<code>Info</code>), <code>CIPPResults</code>, and optional{' '}
+                    <code>Failed</code>/<code>Info</code>/<code>Investigate</code>),{' '}
+                    <code>CIPPResults</code>, and optional{' '}
                     <code>CIPPResultMarkdown</code> to control status and rendering directly (Auto
                     result mode only)
                   </Typography>