Views:

Historical Investigations can quickly identify endpoints which are possible candidates for further analysis. A Historical Investigation uses server metadata to quickly return results.

To access this screen, go to Response > Historical Investigation.

The Historical Investigation screen has two tabs:

Tab

Description

Assessment

Use an assessment to perform the following:

  • Evaluate the prevalence of a threat, and how long the threat has been in the network. The assessment goes through all historical data.

  • Determine the existence of a threat using simple criteria. Assessments support only a limited set of criteria.

An assessment supports the following criteria types:

The assessment goes through the server metadata and updates the result pane as soon it finds a match. It may take a few minutes to completely go through the server metadata.

For more information, see Using User-defined Criteria for Historical Investigations.

Root Cause Analysis Results

If an assessment returns a match, administrators may generate a Root Cause Analysis to:

  • List all related objects to the specified criteria

  • Identify if any of the related objects are noteworthy

  • Review the sequence of events leading to the execution of the matched object.

Generating a Root Cause Analysis may take some time to complete. Use the Root Cause Analysis tab to monitor the progress of the task.

For more information, see Analysis Chains.
Parent topic: Threat Investigation