Investigate

The Investigate module is the access point for all the event activity reported by the FortiDLP Agent and provides a guided search to help you uncover emerging threats.

This module provides two tabs for viewing events:

• Event streams: A view in which events are divided into categories that each contain aggregated data in the form of high-level statistics and trends. This presents you with plenty of options for conducting investigations based on pre-extracted information of interest.
• Activity feed: A view in which, by default, all events are combined in one list, providing you with a chronological perspective of the activity occurring in your organization. You have the flexibility to filter the event categories in view so that you can investigate any events of interest.

Event streams tab

The following table describes the event stream categories that you can examine and search across from either tab.

Event stream categories

Event streams	Description
Action (Legacy)	Captures events related to manual (operator-initiated) and automated (policy-initiated) actions for Agent 10.5.3 and earlier.
Action (New)	Captures events related to manual (operator-initiated) and automated (policy-initiated) actions for Agent 11.0.1 and later.
Application	Captures events related to foreground application changes.
Browser	Captures events related to browser use, such as when a user visits a URL, or uploads or downloads a file.
Detection	Captures events related to detections, including policy and Agent offline detections.
Email	Captures events related to outbound Microsoft Outlook email activity.
File access	Captures events related to file access, such as when a file is opened, modified, closed, executed, deleted, or renamed.
Google Drive	Captures events collected from Google Drive.
Login	Captures events related to login activity.
Network connection	Captures events related to network connections.
Print	Captures events related to print jobs sent to virtual and physical printers.
Process start	Captures events related to executed processes.
SharePoint & OneDrive	Captures events collected from Microsoft SharePoint and OneDrive.
USB device	Captures events related to USB composite and storage device connections and disconnections.
Wi-Fi	Captures events related to Wi-Fi network connections.

For detailed information about performing searches, see Searches.