The investigation case details such as summary and similar investigations are available to help you with relevant details during an investigation. Also, you can add investigation descriptions and notes based on your findings. The analyst who creates the investigation case is recommended to add all the relevant information related to an investigation. This information helps other analysts to understand the investigation's progress.
Log on to Trellix EDR as an administrator.
Select Menu → Investigating to open the Investigating dashboard.
Open an investigation that you want to analyze and do further analysis.
Select Summary to check details such as the date of creation and the current owner of the investigation.
In the Description option, type the summary of your investigation and click Save.
In the Summary view, set the priority and status:
Set Priority as high, medium, or low based on the impact of a threat on the endpoint to investigate and remediate it.
Set Status as applicable to track the progress of an investigation.
Select Notes to add specific information to help other analysts continue the investigation.
Select Linked investigations to link an investigation to the current case if there are any associations or common artifacts between them. This enables you to identify the list of investigations that are similar to the current investigation.
In Search Investigations, type the required keyword to search, then click Enter to view the search results in the Search Workspace.
Note
Make sure to select All Investigations in the drop-down list next to the Search option.
In the Search Workspace, determine the investigation to be linked to the current investigation, from the Take an action drop-down list, click Link Case.
In the Description option, type the required description, then click Confirm.
Select Similar investigations to check investigations that are similar to other investigations based on the common processes used.