IOC rules can also be used to investigate system snapshots. To use IOC rules, follow the same guidelines mentioned in Historical Records.
For details, see IOC Rule.