Table of Contents | ||||
---|---|---|---|---|
|
...
Investigations are the base for knowledge sharing in the Security Operations application. Users will create an investigation when something strange is detected on the Overview Dashboard, or in the Triage or Hunting areas, and then can perform a deeper investigation around the problem or simply write the first impressions and assign the investigation to a specialist in this kind of threat.
Click this icon the Investigations button in the top navigation bar to access the Investigations this area.
...
Create a new investigation or add information to an existing one
...
In the Investigations area, clicking click the yellow + icon. In this case, you can only create investigations from scratch.
In the Triage area, after filtering alerts, you can click the Add to investigation button next to each group of alerts to create an investigation related to those alerts. All the elements you add to an investigation in this way will be added to the Investigation list, which you can access by clicking the paper clip icon at the top right corner of the application. Learn more about the Investigation list.
...
...
In the Hunting area, click the Add to investigation button after performing a search. In this case, elements will be also added to the Investigation list. Learn more about this in the Threat Hunting article.
...
Filter investigations
You can use the filters at the top of the Investigations area to filter specific investigations.
Rw ui steps macro | ||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
First, choose the time range you want to apply to your search by clicking the time selector at the top of the area. You can either choose an absolute time range selecting the start and end dates in the calendar or select a preset interval. You can also select a start date and activate the Now toggle to set the ending date to the current time. Click OK after choosing the time range.
After applying a specific time range, you can click the play button next to the selector to activate real-time. This will allow new results to keep appearing as time passes.
Then, set the conditions you want to filter by. These are the available options:
You can also select the Advanced Filters button to filter by the following criteria:
Click Filter. |
...
If you start defining a new filter or start defining a new filter, you can click Reset filters to ❤ to set your favorite filter.
...