Edit the incident as required.
Create a report to capture investigation specific data and share it with team members.
Add child incident
Adds a child incident to the incident.
Child investigations are used to compartmentalize sensitive War Room activity. You can create child investigations to collaborate discreetly with a select group of people on a specific topic of investigation. Child investigations are also used in situations where a secondary investigation is needed and its content may add too much "noise" in the original investigation.
You can also create child investigations from the CLI using the
To turn the child investigation to a discrete investigation, select the
Closing a parent investigation also closes all associated child investigations.
Restrict an investigation to the incident owner and team.
Marks the incident as closed.
Deletes the incident
You can see a summary of the incident, timeline information, labels, and indicators.
Add tasks for users to complete as part of an investigation.
Details of any D2 Agents that are deployed to perform forensic tasks on machines.
Add team members to the incident.
View context data. The context is a map (dictionary) that is created for each incident and is used to store structured results from the integration commands and automation scripts. The context keys are strings and the values can be strings, numbers, objects, and arrays.
You can use context data to: