Adding a guided query to an investigation
To add a guided query to an investigation:
-
Go to Investigations > Investigate and open an investigation in the list.
-
Click the Add Guided Queries button. Alternatively, click on Add menu (+) in the top-right corner of the page and select Add Guided Queries. The Add Guided Queries page opens.
-
Click Select.
- Configure the query settings.
Date range Use the date picker to configure the date range. Enable Facets Select to return the panel that allows narrowing the search. This may make the query longer to complete. For more information, see Facet Search. Variables Enter the required variable(s) for the queries. Multiple variables are supported.
Values can be entered either as:
Individual items, followed by the tab or enter key. The value appears as a pill that can then be deleted, if required.
Bulk indicator icon. This brings up an entry screen. Pasting the text is supported. After pressing the button, FortiNDR Cloud extracts the applicable indicators from the text and adds them as variables. You can also delete the unneeded variables.
Create a New Investigation Select this option to create a new investigation. Enter the Investigation Name and Description.
The default name for new investigations is the first and last name of the user creating the investigation as well as a date stamp of when the investigation was created.
Add to Existing Investigation
From the Choose Investigation dropdown, select and investigation.
-
Click Run Guided Query.