Investigation Actions

When you are working on an Investigation a number of different actions are available to manage your investigation.  This article discusses the different actions you can take:

1. Create
2. Edit
3. Notes
   • Add
   • Edit
   • Delete
   • Share
4. Snooze
5. Close
6. View Open
7. View Closed

Tip: If you are new to Investigations you should review Investigations Overview 

Create an Investigation

There are multiple methods to create an investigation based on individual alerts, multiple alerts or simply a placeholder to add alerts at a later stage.

To create an investigation based on alert(s):

1. Select Dashboards from the left hand menu
2. Select Alert Management
3. You will now view the Alerts Management dashboard and all Alerts
4. Select the relevant Alerts by checking the box beside each relevant alert
5. Select (more options) at the right of the table and select Assign or Create Investigation
6. You will be presented with the Assign Alerts to Investigation page
7. Within the Create new Investigation window
8. Enter a Name for the investigation
9. Select a Priority
10. Select a Type
11. Assign the investigation to yourself or another user of your tenant
12. Select Create and Assign

To create an empty investigation (no alerts assigned), you can assign alert(s) later:

1. Select Investigations from the left hand menu
2. Select Create New
3. Enter a Name for the investigation 
4. Select a Priority
5. Select a Type
6. Assign the investigation to yourself or another user of your tenant
7. Select Create

To assign alert(s) to the empty investigation:

1. Select Dashboards from the left hand menu
2. Select Alert Management
3. You will now view the Alerts Management dashboard and all Alerts
4. Select the relevant Alerts by checking the box(es) within the Alert widget
5. Select the (more options) at the top right of the table and select Assign or Create Investigation
6. You will be presented with the Assign Alerts to Investigation page
7. Select Assign to existing Investigation and from the pull down menu select the Investigation name you created.
8. Select Assign

Edit an Investigation

1. Select Investigations from the left hand menu
2. Within the Open Investigations window, select the Investigation you wish to edit
3. You can:
   • Change the Status, Assign to a different user and Priority of the Investigation
4. If you want to unassign Alerts to the investigation, select the relevant Alert
5. Click on the (more options) to the right of the alert and select Unassign

Investigation Notes

Using the notes feature you can document findings during an investigation to reflect progress made, conclusions drawn and communicate all information to other users of your Samurai XDR tenant. 

Notes are associated within an individual investigation and are added using a WYSIWYG editor. Each note contains the following information:

• Time-stamp
  • Last updated date and time in the format [yyyy:mm:dd], [hh:mm:ss]
• Contributors
  • User that created the note represented as an icon with initials of the user
  • Users that have modified the note
  • Hover over the icon to display the users email address

The WYSIWYG editor provides the following functionality:

Toolbar button	Name	Action
	Code block	Insert code block
	Insert/edit URL	Create or edit a URL link
	Bold	Bold or unbold text
	Italic	Italicize or remove italics
	Underline	Underline or remove underline from text
	Bulleted list	Create or remove a bulleted list
	Numbered list	Create or remove a numbered list
	Table	Create or modify a table
	Character counter	Counter showing number of character used and limit of 5000
	Save / update	Save or update a note
	Share	Copies the URL of the note to share with other users in your tenant
	Open in new window	Opens the note in a new window
	Edit	Allows you to edit and update a saved note
	Delete	Delete the note
	Exit edit mode	Exit note edit mode
	Confirm update	Save and update note

Add Note

1. Select the relevant Investigation within the Investigations menu. 
2. Click on the Notes icon
3. You can now add free form text within the field using the WYSIWYG editor
4. Click to save the Note

Edit Note

1. Select the relevant Investigation within the Investigations menu. 
2. Click on the Notes icon
3. Select the relevant Note you wish to edit
4. Click on (more options) and select (edit)
5. Once complete  click to save or if you wish to forget the update

Delete Note

1. Select the relevant Investigation within the Investigations menu. 
2. Click on the Notes icon
3. Select the relevant Note you wish to delete
4. Click on (more options) and select (delete)

Share Note

1. Select the relevant Investigation within the Investigations menu. 
2. Click on the Notes icon
3. Select the relevant Note you wish to delete
4. Click on (more options) and select (share)
5. The URL of the note will be copied to your clipboard and can be shared with other users of your tenant

Snooze an Investigation

1. Select Investigations from the left hand menu
2. Within the Open Investigations window, select the Investigation you wish to snooze
3. From the Status drop down menu, select Snooze
4. You can now Define the snooze period for the Investigation
5. Select the Duration
6. Provide a Description for why you are snoozing the investigation
7. Select Confirm
8. Within the Open Investigations page you will now see the Status is updated to Snooze

Close an Investigation

1. Select Investigations from the left hand menu
2. Within the Open Investigations widget, select the Investigation you wish to snooze
3. From the Status drop down menu, select Closed
4. To close the Investigation you should select one of the options presented:
   • Security Incident Confirmed
   • False-Positive
   • True-Positive (from legitimate host)
5. Provide a reason behind closing the investigation

View Open Investigations

1. Select Investigations from the left hand menu
2. View the Open Investigations widget, this will list all investigations that are Open or in Snooze status
3. You can filter on the Status field for Open investigations

Alternatively you can view the latest Investigations widget within Dashboards > Alert Management 

View Closed Investigations

1. Select Investigations from the left hand menu
2. View the Closed Investigations widget