Views:
Historical Investigations can quickly identify endpoints which are possible candidates for further analysis. A Historical Investigation uses server metadata to quickly return results.
To access this screen, go to Response → Historical Investigation.
The Historical Investigation screen has two tabs:
Tab
Description
Assessment
Use an assessment to perform the following:
  • Evaluate the prevalence of a threat, and how long the threat has been in the network. The assessment goes through all historical data.
  • Determine the existence of a threat using simple criteria. Assessments support only a limited set of criteria.
An assessment supports the following criteria types:
The assessment goes through the server metadata and updates the result pane as soon it finds a match. It may take a few minutes to completely go through the server metadata.
For more information, see Using User-defined Criteria for Historical Investigations.
Root Cause Analysis Results
If an assessment returns a match, administrators may generate a Root Cause Analysis to:
  • List all related objects to the specified criteria
  • Identify if any of the related objects are noteworthy
  • Review the sequence of events leading to the execution of the matched object.
Generating a Root Cause Analysis may take some time to complete. Use the Root Cause Analysis tab to monitor the progress of the task.
For more information, see Analysis Chains.
Related information