Documentation Center
AlienVault® USM Anywhere™

Adding an Event to an Investigation

Role Availability Read-Only Analyst   Manager

USM Anywhere enables you to associate events with an investigation.

Important: You can link up to 100 events to each investigation.

To add an event to an investigation

  1. Go to Activity > Event.
  2. Locate the event you want to add to the investigation and click it. See Searching Events for assistance.
  3. Click Add to Investigation.
  4. Search the investigation. You can enter the title or the number that identifies each investigation.
  5. Note: Click Create New Investigation if you want to start a new investigation. See Creating New Investigation for more information.

  6. Click Save.
  7. The connection has been done and you can see it from Investigations. See Evidence on Investigations for more information.