USM Anywhere enables you to associate events with an investigation.
Important: You can link up to 100 events to each investigation.
To add an event to an investigation from the Events Details page
-
Go to Activity > Event.
-
Locate the event you want to add to the investigation. See Searching Events for more information.
-
In the Investigation field, click the
icon to edit it and enter the title or the number that identifies the investigation.
-
Click Apply.
The connection has been done and you can see it from Investigations. See Evidence on Investigations for more information.