When you remove an event from an investigation, it continues to exist in the system but is no longer included in the investigation.
- On the navigation bar, click Investigations.
The Default investigation displays.
- Click the Investigation drop-down menu in the top-left corner and open an investigation.
- Click Actions > Remove Events.