USM Anywhere™

Evidence on Investigations

Role Availability Read-Only Analyst Manager

This section displays the alarms, events, and files associated with the investigation.

Important: You can link up to 100 alarms and 100 events to each investigation.

Evidence section on the details of a case investigation

You can click an alarm or an event to go to the alarm or event.

The asset name includes the icon if the asset is not in the system, or the icon if the asset has been added to the system.

Click the icon to access these options:

  • Add to current filter: Use this option to add the asset name as a search filter. See Searching Events for more information.
  • Find in events: Use this option to execute a search of the asset name in the Events page. See Searching Events for more information.
  • Add asset to system: Use this option to create the asset in the system. See Adding Assets for more information.
  • Look up in OTX: This option searches the IP address of the source asset in the AT&T Cybersecurity Alien Labs Open Threat Exchange® (OTX™) page. See Using OTX in USM Anywhere for more information.

Click the icon to access these options:

  1. Go to Activity > Alarms.
  2. Search for the alarms you want to add to the investigation and select them. See Searching Alarms for assistance.
  3. Click the icon and select an investigation. You can also create a new one. See Creating New Investigation for more information.

    Add an alarm to an investigation

  4. Click Save.
  1. Go to Activity > Events.
  2. Search for the event that you want to add to the investigation and select it. See Searching Events for assistance.
  3. Click the icon and select an investigation. You can also create a new one. See Creating New Investigation for more information.

    Add an event to an investigation

  4. Click Save.
  1. Go to Investigations.
  2. Locate the investigation in the Investigations list and select it.
  3. In the Evidence section, locate the alarm or the event that you want to remove from the investigation and click the icon.
  4. In the confirmation dialog box, click Remove.
  1. Go to Activity > Alarms or Activity > Events depending on if you want to remove an alarm or an event.
  2. Locate the alarm or event that you want to remove from the investigation and select it. See Searching Events for assistance.
  3. Click the icon located in the Investigation field.
  4. Select the investigation you want to remove the link.
  5. Click Unlink From Investigation.
  6. In the confirmation dialog box, click Unlink.

When adding a file to an investigation, keep in mind these points:

  • There is a maximum file size of 24 MB.
  • There is a maximum number of five attachments per investigation.

To add a file to an investigation

  1. Go to Investigations.
  2. Locate the investigation in the Investigations list and select it.
  3. In the Evidence section, click Select the file from your desktop.
  4. Select the file and click Open.

    5. The file displays in the list.