Reporting: Investigate a Report

Document created by RSA Information Design and Development on Nov 23, 2016Last modified by RSA Information Design and Development on Feb 10, 2017
Version 5Show Document
  • View in full screen mode
  

This topic provides instructions on how to investigate a report. You can investigate a report by directly navigating to the Investigation module from the report. With the Investigate a report option, you can investigate for each event mentioned in the report.

This topic provides instructions on how to investigate a report. You can investigate a report by directly navigating to the Investigation module from the report. With the Investigate a report option, you can investigate for each event mentioned in the report.

Prerequisites

Make sure that:

  • You have understood the components of the Report view. For more information, see Report View.
  • You have understood the components of the View All Reports Panel. For more information, see View All Reports Panel.

Procedure

Perform the following steps to investigate a report:

  1. In the Security Analytics menu, select Reports.
    The Manage tab is displayed.
  2. Click Reports.
    The Report view is displayed.
  3. In the Report toolbar, click View All Reports.
    The View All Reports tab is displayed.

    Note: If no reports are displayed in the View All Reports, select a date for which you want to display the reports.

  1. Double-click the report name to view the report details.
    The Report details screen is displayed.
    investigate_using_reports.png
  2. Click on an ip.src address on the report to view it in the Investigation module.

Note: If you want to manually copy the result data and use it for investigation, make sure that the the binary values are prefixed with 'hex:'.

Next Steps

Perform the following tasks:

  1. You can print, save, email, and view reports on full screen.
  2. You can select a date from the calendar to view a list of successfully run reports for the chosen date.
You are here
Table of Contents > Working with Reports in the Reporting Module > Investigate a Report

Attachments

    Outcomes