Viewing the Action details panel

To view the Action details panel, follow these steps.

How to display the Action details panel

1. On the left-hand sidebar, click .
2. Do one of the following:
   • To open the panel from the Event stream tab:
     1. Click the Action (New) or Action (Legacy) event stream.
     2. In the Events section, select the table row of the relevant action event.
        
   • To open the panel from the Activity feed tab:
     1. Select the Activity feed tab.
     2. On the top-right side of the tab, click Event streams and ensure that the Action (New) and/or Action (Legacy) checkboxes are selected.
     3. Select the table row of the relevant action event.

The Action details panel displays.

3. Optionally, do the following:
   • To filter events by a specific value in the panel or view more information about a value, click the value and then click the relevant context box button.

   The following list summarizes the buttons that display: Filters the current page for events with the same value. Filters the current page for events without the value. Copies a value to your clipboard. Displays more information about a value. Displays a submenu containing the following options: Filters by a value within the Users module. Filters by a value within the Nodes module (if selected from a user's context box) or takes you to the Node profile page (if selected from a node's context box).

   • To filter the page for events occurring before, after, or around the same time as the event, click the timestamp and set your preferred time range.

   For example, selecting 10 minutes and the Around menu option would filter for events occurring during the 10 minutes before the timestamp and the 10 minutes after the timestamp.

   • To view a related detection in the Investigate module, in the Associated detection section, click .
   • To download a generated shadow copy, Agent performance report, or Agent debug bundle, in the Key information & content section, click Download.
   • To add the action event to a case, click Add to case and add the event to a new or existing case. For more on cases, see Cases.
   • To view details for a failed action, clickto expand the Action log.