You can create customized investigations and then add events to those investigations.
- On the navigation bar, click Investigations.
The Default investigation displays.
- Click Actions > Add Investigation.
The Add Investigation window displays.
- Enter a name for the investigation and click Save.
Note: The name must be alpha-numeric. Special characters are not allowed.The new investigation displays in the Investigations window, but it is empty until you add events to it. See Add an Event to an Investigation.