> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# USM Anywhere Investigations

|                       |               |                  |             |             |
| --------------------- | ------------- | ---------------- | ----------- | ----------- |
| **Role Availability** | **Read-Only** | **Investigator** | **Analyst** | **Manager** |

Using USM Anywhere, you can create investigations and organize the information from your environment. This feature enables you to manage and coordinate incident response activities. Use Investigations for linking <Tooltip tip="Alarms provide notification of an event or sequence of events that require attention or investigation.">alarms</Tooltip>, <Tooltip tip="Any traffic or data exchange detected by LevelBlue products through a sensor or external devices such as a firewall.">events</Tooltip>, notes, and other files to their responses, and you will have a complete view of actions you have taken to address a particular threat.

This topic discusses these subtopics:

[Investigations List View](/documentation/usm-anywhere/user-guide/investigations/investigations-list-view)

[Creating a New Investigation](/documentation/usm-anywhere/user-guide/investigations/creating-new-investigation)

[Editing Investigations](/documentation/usm-anywhere/user-guide/investigations/editing-investigations)

[Searching Investigations](/documentation/usm-anywhere/user-guide/investigations/searching-investigations)

[Viewing Investigations Details](/documentation/usm-anywhere/user-guide/investigations/viewing-investigations-details)

[Activity on Investigations](/documentation/usm-anywhere/user-guide/investigations/activity)

[Notes on Investigations](/documentation/usm-anywhere/user-guide/investigations/notes)

[Evidence on Investigations](/documentation/usm-anywhere/user-guide/investigations/evidence)

[Deleting Investigations](/documentation/usm-anywhere/user-guide/investigations/deleting-investigations)

[Notification Rule for Investigations](/documentation/usm-anywhere/user-guide/investigations/notification-rule)