You can create customized investigations and then add events to those investigations.


  1. On the navigation bar, click Investigations.
    The Default investigation displays.
  2. Click Actions > Add Investigation.
    The Add Investigation window displays.
  3. Enter a name for the investigation and click Save.
    Note: The name must be alpha-numeric. Special characters are not allowed.
    The new investigation displays in the Investigations window, but it is empty until you add events to it. See Add an Event to an Investigation.