Starting an Investigation

1. Select one of the following options:

   Path	Use When...
   Investigations menu > Start your first investigation button	This is your first investigation.
   Threat Library Actions menu > Start Investigation	You want to add the current object to a new investigation.
   Investigations page > Create Investigation button	General use.
   Top Navigation bar > Create button	General use.

   
   The Create Investigation window is displayed.
   
   
2. Populate the Create Investigation window as follows:
   • Type a Name for the investigation.
   • Select a Status:
     • Open - Open investigations appear as normal on the Investigations page.
     • Closed - Closed investigations appear greyed out on the Investigations page.
   • Select a Priority:

     What is normal or escalated depends upon your organization.

     • Normal
     • Escalated
   • Optionally, type a Description for the investigation.
3. Click Create.
   The investigation workbench appears.

   If you created this investigation via the Threat Library Actions menu, the associated object is automatically added to the investigation and displayed on the evidence board.

   
   
    

   
   Transcript: TEXT

   Footage from ThreatQ Version 4.57.0