Tag and comment events

Use the tag column to communicate with members of the security team about an event in an investigation. Tags and comments are viewable to any user with access to the investigation. You can use s filter to view only tagged investigations or use the Search function to search for text in notes and comments.

To add a tag to an event:

1. Do one of the following:

   • Click the Investigations tab, open an investigation and click View Results.

   • Go to Investigations > Search timeline. In the Search Timeline tab, click View Results.

2. Click the tag column next to the event. The Tag and Comment dialog opens.

   

3. Select a tag from the dropdown.

4. (Optional) Add a comment to the event.

5. Click Save. The tag and comment icons are displayed in the tag column.

To remove a tag from an event:

1. Click the tag column next to the event. The Tag and Comment dialog opens.

2. Click Delete and then click Confirm in the dialog that opens.

Viewing and filtering tagged events

Tagged events are displayed in the Investigations and Search Timeline tabs. Hover over a tag to see an overview of the tagged events in the investigation.

To use tags and notes to filter investigations:

Option	Description
Go to Investigations > Investigate	Click the Filter icon. In the Tag section, select Tagged Investigations. (Optional) To refine results, select a tab label from the list (such as Evil). Click the investigation name. (Optional) Click Hide Notes to only see the tags. Click View Results.
Go to Investigations > Search Timeline	Click the All Queries drop-down. In the Tag section, select Tagged Investigations. (Optional) To refine results, select a tab label from the list (such as Evil). Click View Results.
Go to Investigations	Enter keywords in the Search field to search for text in comments and notes. Matching results are highlighted in yellow. Hover over the results in the Activities and Notes column. Click a matched note to open the results table displaying the matched results. Click View Details to open the investigation. The matched text will be highlighted.

After you filter the investigations, you can copy the URL to send the filtered view a member of your team.