View Investigations

A summary at the top of the page describes the Investigation and provides a link to the Threat if one was published.

The Investigation details are presented on four tabs:

• Overview

• Investigative Leads

• Related Data

• Related Data (By Query)

Overview Tab

The Overview tab contains relevant information about the scope of the investigation, including affected identities and endpoints.

The Related Identity panel shows summary of the identity, including network addresses and endpoint type. Click on the identity name to view additional details.

The Affected Endpoint panel shows summary of the endpoint, including network addresses and endpoint type. Click on the endpoint name to view additional details. If you have the necessary permissions, you can use the button to contain a Threat directly from the Investigation. See Contain Threats with Network Isolation for more information.

The Investigative Leads panel lists all the leads that comprise the Investigation. Click on the lead name to open the lead in the Investigative Leads tab (see below).

The Detection Analytics panel includes a summary of how Red Canary detected the threat. This includes:

• First Party intelligence: Red Canary intelligence based on threat research or previously confirmed threats

• Red Canary Behavioral Analytic: Native Red Canary intelligence on known malicious behavior

• Third Party intelligence: Intelligence obtained from third parties, including alerts

• Targeted Product: Software identified as potentially unwanted

• Process Memory Signature: Characteristics and metadata of a running process

The Activity panel timeline indicates when each lead was added to the Investigation or when a Threat was published.

Investigative Leads Tab

The Investigative Leads tab shows the core of our analysis, providing detailed information about potentially threatening activities across the Endpoint, Cloud, and Identity domains. Each lead is an individual activity that our detectors identified as potentially suspicious or malicious.

Within each lead, you can:

• View enrichments, such as IP reputation

• Inspect process, identity, and cloud metadata

• Examine alert correlation details

When we identify a lead as non-threatening, we’ll add a note available explaining how we came to that conclusion. If we get additional data to suggests there’s threatening activity occurring, this designation of “not a threat” may be updated accordingly.

The Resource Context panel provides additional information about threats affecting similar endpoints or identities.

First Time Detections
We also clearly mark the first time a specific activity is identified in your environment using the tag. This provides helpful context around new activity, and plays an important part in our analysis process.

Related Data Tab

The Related Data tab shows the same data as the Related Data (By Query) tab (see below), but grouped by data type.

Related Data (By Query) Tab

The Related Data (By Query) tab shows the results of the second phase of enriching an Investigation, where Red Canary’s analysts run numerous queries against various data sources to find other possibly relevant security data. While there are many queries and enrichments we’re doing beyond what you’ll see here, these Related Data searches return results similar to the queries a SOC analyst would do in their SIEM or other data sources.

Related Data can include:

• Other Investigations associated with similar endpoints, identities, or detection analytics

• Alerts associated with the same hostname or identity

Note: The related data shows what was available at the time of investigation. You can refresh this data manually using the Refresh button.