Conducting scoped investigations

Once you have access to a scoped investigation, you can activate it and begin your analysis.

As detailed below, when you "start" an investigation, the FortiDLP Console provides a restricted view of data based on the access granted to you. You can stop the investigation at any point to switch to another task in the FortiDLP Console, and you can return to the investigation when needed, up until its expiry.

How to conduct a scoped investigation

1. In the FortiDLP Console, on the left-hand sidebar, click .
2. Under General, select the Scoped investigations tab.
3. In the My scoped investigations table, at the end of the investigation's table row, click Start.
   You are directed to the Investigate module.

For detailed information about Investigate searches, see Investigate.

4. To stop your investigation:
   1. Click the Scoped investigation modal at the bottom of the page.
   2. Click Stop investigation.