Sharing investigations

The share investigations feature allows users who have multiple FortiNDR Cloud accounts to share investigations from their parent account with users in a child account. Once shared, all users in the child account can view and modify the investigation.

Requirements:

• The user must have multiple accounts
• The investigation must be active.
• Users in both the parent and child accounts must have a User role.

To share an investigation from within an investigation:

1. Go to Investigations > Investigate and do one of the following. Either create a new investigation or open one from the list. Parent account investigations display an account badge.
2. Click the gear icon at the top-right of the page and select Share With Account. The Share with Account dialog opens.
3. Click Confirm. The Investigations page opens. The account badge is removed from the investigation and a confirmation message appears at the top of the page.

To share an investigation with the action menu:

1. Go toInvestigations > Investigate.
2. Locate an investigation in your parent account. Parent account investigations display an account badge.
3. From the actions menu, select Share. The Share with Account dialog opens.

   

4. Click Confirm. The account badge is removed from the investigation and confirmation message appears at the top of the page.