Creating investigations

An investigation is run against the account shown in the account picker. The account name that owns the investigation appears to the right of the investigation name if it differs from your primary account.

If you have access to multiple accounts and the account shown in the account picker is different from the account that contains your user, then the account is listed. If you have access to multiple accounts, and the account shown in the account picker is the same as the account that contains your user, then the account is not shown in the investigation list. The investigation created is run against the account shown in the account picker.

To create an investigation:

1. Go to Investigations and click New Investigation at the top-right corner of the page. The New Investigation dialog opens.

   The default investigation name is the first and last name of the user creating the investigation with the time stamp of when the investigation was created.

2. Enter an Investigation name and Description, then click Create Investigation.
3. Add the following to your investigation:

   • Query: Adding queries to an investigation

   • Playbook: Adding a playbook to an investigation

   • Notes: Adding notes to an investigation

To close an investigation:

1. Go to Investigations and click the investigation you want to close.
2. Click the gear icon at the top-right side of the page and select Close Investigation. A confirmation dialog opens.

   

3. Click Close Investigation.

To delete an investigation:

1. Go to Investigations and click the investigation you want to delete.
2. Click the gear icon at the top-right side of the page and select Delete Investigation. A confirmation dialog opens.
3. Click Confirm.

Deleting an investigation is irreversible and will remove everything in the investigation

To edit an investigation name:

1. Go to Investigations and click the investigation you want to edit.
2. Click the gear icon at the top-right side of the page and select Edit Investigation. A dialog opens.
3. Update the Investigation name and Description and click Save.