Remove an Event from an Investigation

When you remove an event from an investigation, it continues to exist in the system but is no longer included in the investigation.

Procedure

1. On the navigation bar, click Investigations.
   The Default investigation displays.
2. Click the Investigation drop-down menu in the top-left corner and open an investigation.
3. Click Actions > Remove Events.