Create an investigation

Create your own investigations.

We create investigations for the detections that you're most likely to want to investigate. You can also create an investigation, as follows:

1. Go to Threat Analysis Center > Investigations.

2. On the Investigations page, click Actions > Add investigation.

   

3. Enter an investigation name and click Create new investigation.

   

4. In Investigation record, configure the investigation as follows:

   1. Set the priority to High, Medium, or Low.
   2. Leave the status set to In Progress.
   3. Click Type to assign and select the Sophos Central admins who will investigate.

   

5. In Detection list, click Actions > Add detections.

   

6. On the Detections page, select a detection and click Add to investigation.

   Alternatively, click the arrow beside a detection to see its details and select specific reports

   

Now you're ready to investigate. See "Investigate detected events" in Investigations.