Analysts who are investigating data in the Investigation can view and reconstruct events associated with a session.
- Analysts who conduct analysis using Security Analytics Investigation, and have the appropriate system roles and permissions set up for their user accounts, can go from a Navigate view drill point to the Events view.
- Analysts who do not have access to the Navigate view or want to go directly to the Events view, can open sessions and examine the events that make up the session in the Investigation > Events tab.
Separate topics describe methods of working in the Events view.
Previous Topic:View Additional Context for a Data Point
Next Topic:Combine Events from Split Sessions
You are hereTable of Contents > Conduct an Investigation > Examine Events