To investigate an alert in greater depth, click the Investigative Tips tab on an alert details page. This tab provides a set of questions with associated search queries that can help you get a clearer understanding of a particular threat.
Note
Investigative tips are only supplied for alerts that are triggered by a Trellix-supplied rule.
Each question can be expanded to show the search query by clicking the down arrow button next to it. To expand all questions, click Expand All Queries.
Click the search icon to run the search. Results are displayed in the query window.