You can begin an investigation in several ways in Security Analytics. After you begin an investigation, there is no specific order in which to conduct the investigation. Instead, Security Analytics offers various methods of displaying the data, filtering the data, querying the data, acting on a drill point, and inspecting specific events.
Analysts who conduct analysis using Security Analytics Investigation need to have the appropriate system roles and permissions set up for their user accounts. See Roles and Permissions for Analysts. An administrator must configure roles and permissions.
Detailed procedures are: