- Go to Activity > Event.
- Locate the event you want to add to the investigation. See Searching Events for more information.
-
In the Investigation field, click the
icon to edit it and enter the title or the number that identifies the investigation.
Note: Click Create New Investigation if you want to start a new investigation. See Creating a New Investigation for more information. - Click Apply. The connection has been done and you can see it from Investigations. See Evidence on Investigations for more information.
Viewing Event Details
Adding an Event to an Investigation
USM Anywhere enables you to associate events with an investigation.
To add an event to an investigation from the Events Details page