> ## Documentation Index > Fetch the complete documentation index at: https://levelblue-final.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Evidence on Investigations | | | | | | | - | - | - | - | - | | **Role Availability** | Read-Only | Investigator | Analyst | **Manager** | This section displays the alarms, events, and files associated with the investigation. > [!WARNING] > > **Important:** You can link up to 100 alarms and 100 events to each investigation. ![](https://mintcdn.com/levelblue-final/933tAZ_mi6gE6Q_5/images/usm-anywhere/evidence.webp?fit=max\&auto=format\&n=933tAZ_mi6gE6Q_5\&q=85\&s=40e4f3fa0001f2e0076222638ed31aed) You can click an alarm or an event to go to the alarm or event. The asset name includes the ![](https://mintcdn.com/levelblue-final/GL4oAn1YpECTrnAT/images/usm-anywhere/angle-down.svg?fit=max\&auto=format\&n=GL4oAn1YpECTrnAT\&q=85\&s=a9ec3a58594c31242062029b4b501731) icon if the asset is not in the system, or the ![](https://mintcdn.com/levelblue-final/cKzh-9YVd0DIdMRz/images/usm-anywhere/chevron-down.svg?fit=max\&auto=format\&n=cKzh-9YVd0DIdMRz\&q=85\&s=e049d833dbfa2962085c081e5f49503e) icon if the asset has been added to the system. Click the ![](https://mintcdn.com/levelblue-final/GL4oAn1YpECTrnAT/images/usm-anywhere/angle-down.svg?fit=max\&auto=format\&n=GL4oAn1YpECTrnAT\&q=85\&s=a9ec3a58594c31242062029b4b501731) icon to access the following options. Your access to these options may vary based on your user role. See [Role-Based Access Control (RBAC) in USM Anywhere](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/user-management/rbac.md) for more information: * **Add to current filter:** Use this option to add the asset name as a search filter. See [Searching Events](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/events/searching-events.md) for more information. * **Find in events**: Use this option to execute a search of the asset name in the Events page. See [Searching Events](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/events/searching-events.md) for more information. * **Look up in OTX**: This option searches the IP address of the source asset in the LevelBlue LevelBlue Labs Open Threat Exchange® (OTX™) page. See [Using OTX in USM Anywhere](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/otx/using-otx-in-anywhere.md) for more information. * **Add asset to system**: Use this option to create the asset in the system. See [Adding Assets](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/asset-management/asset-administration/adding-assets.md) for more information. Click the ![](https://mintcdn.com/levelblue-final/cKzh-9YVd0DIdMRz/images/usm-anywhere/chevron-down.svg?fit=max\&auto=format\&n=cKzh-9YVd0DIdMRz\&q=85\&s=e049d833dbfa2962085c081e5f49503e) icon to access the following options. Your access to these options may vary based on your user role. See [Role-Based Access Control (RBAC) in USM Anywhere](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/user-management/rbac.md) for more information: * **Add to Current Filter**: Use this option to add the asset name as a search filter. See [Searching Events](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/events/searching-events.md) for more information. * **Find in Events**: Use this option to execute a search of the asset name in the Events page. See [Searching Events](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/events/searching-events.md) for more information. * **Look up in OTX**: This option searches the IP address of the asset in the OTX page. See [Using OTX in USM Anywhere](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/otx/using-otx-in-anywhere.md) for more information. * **Full Details**: See [Viewing Assets Details](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/asset-management/asset-administration/viewing-asset-details.md) for more information. * **Assign Credentials**: See [Managing Credentials](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/vulnerability-assessment/credentials.md) in USM Anywhere for more information. * **Authenticated Scan** (Authenticated scans are performed from inside the machine using a user account with appropriate privileges.): This option displays depending on the USM Anywhere Sensor associated with the asset. See [Running Authenticated Asset Scans](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/asset-management/asset-administration/running-vuln-scan.md) for more information. * **Scan with BlueApp**: This option enables you to run an asset scan through an BlueApp. See [Running Asset Scans Using a BlueApp](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/asset-management/asset-administration/scan-with-alienapp.md) for more information. * **Configuration Issues** (An identified configuration of deployed software or features of software that is in use, which is known to be insecure.): This option opens the Asset Details page. The Configuration Issues tab is selected in the page. See [Viewing Assets Details](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/asset-management/asset-administration/viewing-asset-details.md) for more information. * **Vulnerabilities**: This option opens the Asset Details page. The Vulnerabilities tab is selected in the page. See [Viewing Assets Details](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/asset-management/asset-administration/viewing-asset-details.md) for more information. * **Alarms**: This option opens the Asset Details page. The Alarms tab is selected in the page. See [Viewing Assets Details](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/asset-management/asset-administration/viewing-asset-details.htm) for more information. * **Events** (Any traffic or data exchange detected by LevelBlue products through a sensor or external devices such as a firewall.): This option opens the Asset Details page. The Events tab is selected in the page. See [Viewing Assets Details](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/asset-management/asset-administration/viewing-asset-details.htm) for more information. > [accordion] Link an alarm to an investigation > > 1. Go to **Activity > Alarms**. > > 2. Search for the alarm you want to add to the investigation and select it. See [Searching Alarms](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/alarms/searching-alarms.md) for more information. > > 3. Click the ![](https://mintcdn.com/levelblue-final/SPmy2LqqTlJThUf-/images/usm-anywhere/pencil-new.svg?fit=max\&auto=format\&n=SPmy2LqqTlJThUf-\&q=85\&s=165bba93fb785be56053c468fb2a06fa) icon and select an investigation. You can also create a new one. See [Creating a New Investigation](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/investigations/creating-new-investigation.md) for more information. > > ![](https://mintcdn.com/levelblue-final/9vLvYGhvY8F53Na7/images/usm-anywhere/alarmaddtoinvestigation_thumb_0_60.webp?fit=max\&auto=format\&n=9vLvYGhvY8F53Na7\&q=85\&s=c2a058b9c0b879e299ade640a30fe80d) > > 4. Click **Save**. > [accordion] Link several alarms to an investigation > > 1. Go to **Activity > Alarms**. > > 2. Search for the alarm you want to add to the investigation and select it. See [Searching Alarms](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/alarms/searching-alarms.md) for more information. > > 3. Click Add to Investigation and select an investigation. You can also create a new oneYou can also create a new one. See [Creating a New Investigation](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/investigations/creating-new-investigation.md) for more information. > > ![](https://mintcdn.com/levelblue-final/9vLvYGhvY8F53Na7/images/usm-anywhere/alarmsaddtoinvestigation_thumb_0_60.webp?fit=max\&auto=format\&n=9vLvYGhvY8F53Na7\&q=85\&s=e3f75344227da0630792a01ea73d2405) > > 4. Click **Save**. > [accordion] Link an event to an investigation > > 1. Go to **Activity > Events**. > > 2. Search for the event that you want to add to the investigation and select it. See [Searching Events](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/events/searching-events.md) for assistance. > > 3. Click the ![](https://mintcdn.com/levelblue-final/SPmy2LqqTlJThUf-/images/usm-anywhere/pencil-new.svg?fit=max\&auto=format\&n=SPmy2LqqTlJThUf-\&q=85\&s=165bba93fb785be56053c468fb2a06fa) icon and select an investigation. You can also create a new one. See [Creating a New Investigation](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/investigations/creating-new-investigation.md) for more information. > > ![](https://mintcdn.com/levelblue-final/933tAZ_mi6gE6Q_5/images/usm-anywhere/eventaddtoinvestigation_thumb_0_60.webp?fit=max\&auto=format\&n=933tAZ_mi6gE6Q_5\&q=85\&s=794fb817a5ecc33edb08720aa289fb4b) > > 4. Click **Save**. > [accordion] Remove a link from an investigation > > 1. Go to **Investigations**. > > 2. Click the title of an investigation to display its details. > > 3. In the Evidence section, locate the alarm or the event that you want to remove from the investigation and click the ![](https://mintcdn.com/levelblue-final/3ewB6g_LmXIUaKmn/images/usm-anywhere/unlink.svg?fit=max\&auto=format\&n=3ewB6g_LmXIUaKmn\&q=85\&s=bc2a2c8422be4f67d51c37a478b9bb84) icon. > > ![](https://mintcdn.com/levelblue-final/3ewB6g_LmXIUaKmn/images/usm-anywhere/unlinkevidence_thumb_0_60.webp?fit=max\&auto=format\&n=3ewB6g_LmXIUaKmn\&q=85\&s=40489415d82025dc4dfb917270234912) > > 4. In the confirmation dialog box, click **Remove**. > [accordion] Remove a link from alarms or events > > 1. Go to **Activity > Alarms** or **Activity > Events** depending on if you want to remove an alarm or an event. > > 2. Locate the alarm or event that you want to remove from the investigation and select it. See [Searching Events](https://levelblue-final.mintlify.site/documentation/usm-anywhere/user-guide/events/searching-events.md) for assistance. > > 3. Click the ![](https://mintcdn.com/levelblue-final/SPmy2LqqTlJThUf-/images/usm-anywhere/pencil-new.svg?fit=max\&auto=format\&n=SPmy2LqqTlJThUf-\&q=85\&s=165bba93fb785be56053c468fb2a06fa) icon located in the Investigation field. > > 4. Select the investigation from which you want to remove the link. > > 5. Click **Unlink From Investigation**. > > ![](https://mintcdn.com/levelblue-final/3ewB6g_LmXIUaKmn/images/usm-anywhere/unlinkfrominvestigation_thumb_0_60.webp?fit=max\&auto=format\&n=3ewB6g_LmXIUaKmn\&q=85\&s=9ed5a6f222d67f8b2e6f35afd3712beb) > > 6. In the confirmation dialog box, click **Unlink**. > [accordion] Add a file to an investigation > > When adding a file to an investigation, keep in mind these points: > > * There is a maximum file size of 24 MB. > * There is a maximum number of five attachments per investigation. > > **To add a file to an investigation** > > 1. Go to **Investigations**. > > 2. Click the title of an investigation to display its details. > > 3. In the Evidence section, click **Select the file from your desktop** or drop your file in the section. > > ![](https://mintcdn.com/levelblue-final/933tAZ_mi6gE6Q_5/images/usm-anywhere/evidencefiles_thumb_0_60.webp?fit=max\&auto=format\&n=933tAZ_mi6gE6Q_5\&q=85\&s=8391e147122930bea5655ae47864ee4d) > > 4. Select the file and click **Open**. > > The file displays in the list.