Add evidence to the evidence board to assist with your
investigation. Mark any entity as evidence in the Cortex XSOAR War
You can view or designate any entity
as evidence which enables you to reconstruct attack chains and piece
together key pieces of verification for root cause discovery.
you can mark any entity
as evidence by clicking the flag next to each entry. You can view
the evidence in the
or open the evidence
entry from the
. When adding
evidence you need to add a description which should contain enough
details that can be used for future reference. Adding a tag helps
you to find the evidence by searching for the tag. You can also
add an occurrence date and time.
The Evidence Board
The Evidence board stores key artifacts for current
and future analysis. You can view and manage evidence entities that
were detected in the
You can search for evidence and select the date
range when the evidence occurred.