Scan disk files using OpenIOC: objects on the disk that match the rules provided in an OpenIOC file
After selection, Endpoint Sensor displays a preview of the OpenIOC file. Review the preview to verify if the OpenIOC file contains supported indicators and conditions. Unsupported combinations are formatted with a strike-through and are ignored during the investigation.
For more information, see Supported IOC Indicators for Live Investigations.
Scan in-memory processes using YARA: objects currently in memory that match the rules provided in a YARA file
Search registry: registry keys, names and data that match criteria defined by the user
The Target Endpoints screen may not show all endpoints selected for the investigation.
A user can only view endpoints where he has been granted sufficient access rights.
Only available for Security Agents installed on Windows platforms.
Period: Specify a starting and ending date for the investigation. The investigation only runs within the dates provided. The default period is set to one month.
Frequency: Specify how often the investigation repeats during the duration of the schedule. The default frequency is set to Daily at 08:00.
For details, see Scheduled Investigation.
For details, see Reviewing the Scheduled Investigation History.