Learn how to create, delete, and configure workspaces in the Forensics app.
The War Room tab allows you to create and manage workspaces. Use workspaces to organize collected evidence and create investigation timelines.
The following table outlines the actions available on the War Room
tab:
|
Action
|
Description
|
|
Create a workspace
|
Click Create Workspace to create a new workspace.
|
|
Search for a workspace by name
|
In Keyword, begin typing to find matching workspace names.
|
|
View a workspace
|
Click the workspace name to go to the workspace.
|
|
View a case
|
Click a case ID to display it in the Case
Viewer.
|
|
Update impacted endpoints
|
In Case Viewer, click Update Forensics Workspace to update a
workspace with impacted endpoints.
If the case no longer includes an endpoint, Vision One does not automatically remove
the
endpoint. You can manually delete any unimpacted endpoints from the workspace.
|
|
Delete a workspace
|
Locate a workspace, click
 at the end of the row, and click Delete
Workspace to delete a workspace. |
|
Change the settings of a workspace
|
Locate a workspace, click
at the end of the row, and click
Modify Workspace to change the name or description of a
workspace. |