For details, see Running an Investigation.
The Endpoint Sensor Investigation widget also supports importing C&C callback events as investigation criteria.
The screen refreshes and displays the progress of the investigation.
To stop an ongoing investigation, click Cancel.