USM Anywhere Investigations

Role Availability	Read-Only	Investigator	Analyst	Manager

Using USM Anywhere, you can create investigations and organize the information from your environment. This feature enables you to manage and coordinate incident response activities. Use Investigations for linking alarms, events, notes, and other files to their responses, and you will have a complete view of actions you have taken to address a particular threat.

This topic discusses these subtopics:

Investigations List View

Creating a New Investigation

Editing Investigations

Searching Investigations

Viewing Investigations Details

Activity on Investigations

Notes on Investigations

Evidence on Investigations

Deleting Investigations

Notification Rule for Investigations