You can investigate a report by directly navigating to the Investigation module from the report. With the Investigate a report option, you can investigate for each event mentioned in the report.
Make sure that:
- You have understood the components of the Report view. For more information, see Report View.
- You have understood the components of the View All Reports Panel. For more information, see View All Reports Panel.
Perform the following steps to investigate a report:
- In the Security Analytics menu, click Dashboard > Reports.
The Manage tab is displayed.
- Click Reports.
The Report view is displayed.
- In the Report toolbar, click View All Reports.
The View All Reports tab is displayed.
Note: If no reports are displayed in the View All Reports, select a date for which you want to display the reports.
- Double-click the report name to view the report details.
The Report details screen is displayed, as shown below:
- Click on an ip.src address on the report to view it in the Investigation module.
Note: If you want to manually copy the result data and use it for investigation, make sure that the the binary values are prefixed with 'hex:'.
Perform the following tasks:
- You can print, save, email, and view reports on full screen.
- You can select a date from the calendar to view a list of successfully run reports for the chosen date.