Reporting: Investigate a Report

Document created by RSA Information Design and Development on Jul 29, 2016
Version 1Show Document
  • View in full screen mode

You can investigate a report by directly navigating to the Investigation module from the report. With the Investigate a report option, you can investigate for each event mentioned in the report.


Make sure that:

  • You have understood the components of the Report view. For more information, see Report View.
  • You have understood the components of the View All Reports Panel. For more information, see View All Reports Panel.

Perform the following steps to investigate a report:

  1. In the Security Analytics menu, click Dashboard > Reports.
    The Manage tab is displayed.
  2. Click Reports.
    The Report view is displayed.
  3. In the Report toolbar, click View All Reports.
    The View All Reports tab is displayed.

    Note: If no reports are displayed in the View All Reports, select a date for which you want to display the reports.

  1. Double-click the report name to view the report details.
    The Report details screen is displayed, as shown below:
  2. Click on an ip.src address on the report to view it in the Investigation module.

Note: If you want to manually copy the result data and use it for investigation, make sure that the the binary values are prefixed with 'hex:'.

Next Steps

Perform the following tasks:

  1. You can print, save, email, and view reports on full screen.
  2. You can select a date from the calendar to view a list of successfully run reports for the chosen date.
You are here: Working with Reports in the Reporting Module > Investigate a Report