Evidence on Investigations

Role Availability Read-Only Investigator Analyst Manager

This section displays the alarms, events, and files associated with the investigation.

Important: You can link up to 100 alarms and 100 events to each investigation.

Evidence section on the details of a case investigation

You can click an alarm or an event to go to the alarm or event.

The asset name includes the icon if the asset is not in the system, or the icon if the asset has been added to the system.

Click the icon to access the following options. Your access to these options may vary based on your user role. See Role-Based Access Control (RBAC) in USM Anywhere for more information:

  • Add to current filter: Use this option to add the asset name as a search filter. See Searching Events for more information.
  • Find in events: Use this option to execute a search of the asset name in the Events page. See Searching Events for more information.
  • Look up in OTX: This option searches the IP address of the source asset in the LevelBlue LevelBlue Labs Open Threat Exchange® (OTX™) page. See Using OTX in USM Anywhere for more information.
  • Add asset to system: Use this option to create the asset in the system. See Adding Assets for more information.

Click the icon to access the following options. Your access to these options may vary based on your user role. See Role-Based Access Control (RBAC) in USM Anywhere for more information:

  1. Go to Activity > Alarms.
  2. Search for the alarm you want to add to the investigation and select it. See Searching Alarms for more information.

  3. Click the icon and select an investigation. You can also create a new one. See Creating a New Investigation for more information.

    Add an alarm to an investigation

  4. Click Save.
  1. Go to Activity > Alarms.
  2. Search for the alarms you want to add to the investigation and select them. See Searching Alarms for more information.

  3. Click Add to Investigation and select an investigation. You can also create a new one. See Creating a New Investigation for more information.

    Add several alarms to an investigation

  4. Click Save.
  1. Go to Activity > Events.
  2. Search for the event that you want to add to the investigation and select it. See Searching Events for assistance.

  3. Click the icon and select an investigation. You can also create a new one. See Creating a New Investigation for more information.

    Add an event to an investigation

  4. Click Save.
  1. Go to Investigations.
  2. Click the title of an investigation to display its details.

  3. In the Evidence section, locate the alarm or the event that you want to remove from the investigation and click the icon.

    Unlink an alarm from an investigation

  4. In the confirmation dialog box, click Remove.
  1. Go to Activity > Alarms or Activity > Events depending on if you want to remove an alarm or an event.
  2. Locate the alarm or event that you want to remove from the investigation and select it. See Searching Events for assistance.
  3. Click the icon located in the Investigation field.
  4. Select the investigation from which you want to remove the link.

  5. Click Unlink From Investigation.

    Unlink an alarm or event from investigation

  6. In the confirmation dialog box, click Unlink.

When adding a file to an investigation, keep in mind these points:

  • There is a maximum file size of 24 MB.
  • There is a maximum number of five attachments per investigation.

To add a file to an investigation

  1. Go to Investigations.
  2. Click the title of an investigation to display its details.

  3. In the Evidence section, click Select the file from your desktop or drop your file in the section.

    Files in the details of an investigation

  4. Select the file and click Open.

    5. The file displays in the list.