--- title: "View Investigations" slug: "view-investigations" updated: 2026-09-09T16:09:40Z published: 2026-09-09T16:09:40Z canonical: "docs.redcanary.com/view-investigations" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # View Investigations Use the **Investigations** page to view all the potential threats Zscaler MDR has identified in your organization. You can drill down into individual Investigations to examine the leads or to review our Threat/non-threatening determination. The top level page uses six sortable columns of data to summarize the potential threats: - **ID** - The Investigation ID - **Investigative Leads** - The total number of leads in the Investigation, with a count showing how many have been reviewed by Zscaler MDR to date - **Originating Activity At** - The date and time (UTC) for the lead that initiated the Investigation - **Last Update** - The date and time (UTC) of the most recent update to the Investigation - **Resources** - The [identity](/doc/docs/identities) or [endpoint](/doc/docs/endpoints) affected by the leads - **Resulting Threats** - A link to the published [Threat](/doc/docs/threats) (if any) that resulted from the Investigation ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/investigations_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) ## Viewing Investigation Details You can examine the details for an individual Investigation by clicking on the Investigation ID. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/investigations_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) A **summary** at the top of the page describes the Investigation and provides a link to the Threat if one was published. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/investigations_04.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) The Investigation details are presented on the following tabs: - [Overview](/doc/docs/view-investigations#overview-tab) - [Investigative Leads](/doc/docs/view-investigations#investigative-leads-tab) - [Related Data](/doc/docs/view-investigations#related-data-tab) - [Related Data (By Query)](/doc/docs/view-investigations#related-data-by-query-tab) - [Related Data Insights](/doc/docs/view-investigations#related-data-insights-tab) ### Overview Tab The **Overview** tab contains relevant information about the scope of the investigation, including affected identities and endpoints. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/investigations_05.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) The **Related Identity** panel shows summary of the identity, including network addresses and endpoint type. Click on the identity name to view additional details. The **Affected Endpoint** panel shows summary of the endpoint, including network addresses and endpoint type. Click on the endpoint name to view additional details. If you have the necessary permissions, you can use the ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/investigate_endpoint_icon.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) button to contain a Threat directly from the Investigation. See [Contain Threats with Network Isolation](/doc/docs/contain-threats-with-network-isolation) for more information. The **Investigative Leads** panel lists all the leads that comprise the Investigation. Click on the lead name to open the lead in the Investigative Leads tab (see below). The **Detection Analytics** panel includes a summary of how Zscaler MDR [detected the threat](/doc/docs/analytics-detectors). This includes: - First Party intelligence: Zscaler MDR intelligence based on threat research or previously confirmed threats - Zscaler MDR Behavioral Analytic: Native Zscaler MDR intelligence on known malicious behavior - Third Party intelligence: Intelligence obtained from third parties, including alerts - Targeted Product: Software identified as [potentially unwanted](/doc/docs/handling-potentially-unwanted-products) - Process Memory Signature: Characteristics and metadata of a running process The **Activity** panel timeline indicates when each lead was added to the Investigation or when a Threat was published. ### Investigative Leads Tab The **Investigative Leads** tab shows the core of our analysis, providing detailed information about potentially threatening activities across the Endpoint, Cloud, and Identity domains. Each lead is an individual activity that our detectors identified as potentially suspicious or malicious. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/investigations_06.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) Within each lead, you can: - View enrichments, such as IP reputation - Inspect process, identity, and cloud metadata - Examine alert correlation details When we identify a lead as non-threatening, we’ll add a note available explaining how we came to that conclusion. If we get additional data to suggests there’s threatening activity occurring, this designation of “not a threat” may be updated accordingly. The **Resource Context** panel provides additional information about threats affecting similar endpoints or identities. **First Time Detections** We also clearly mark the first time a specific activity is identified in your environment using the ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/first_time_detection_icon.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) tag. This provides helpful context around new activity, and plays an important part in our analysis process. ### Related Data Tab The **Related Data** tab shows the same data as the **Related Data (By Query)** tab (see below), but grouped by data type. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/investigations_07.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) ### Related Data (By Query) Tab The **Related Data (By Query)** tab shows the results of the second phase of enriching an Investigation, where Zscaler MDR’s analysts run numerous queries against various data sources to find other possibly relevant security data. While there are many queries and enrichments we’re doing beyond what you’ll see here, these Related Data searches return results similar to the queries a SOC analyst would do in their SIEM or other data sources. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/investigations_08.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) Related Data can include: - Other Investigations associated with similar endpoints, identities, or detection analytics - Alerts associated with the same hostname or identity - For customers with the [Zscaler OneAPI integration](/doc/docs/integrate-zscaler-oneapi-with-red-canary), Zscaler Internet Access weblogs associated with similar endpoints, identities, or transactions - [Security Data Lake](/doc/docs/supported-integrations-security-data-lake) logs associated with similar endpoints, identities, or transactions For Security Data Lake sources, users can customize the query being run by clicking **View in Data Lake**, which will open the query in the Security Data Lake [Search](/doc/docs/searching-your-data) page: ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/investigations_09.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) > [!NOTE] > **Note**: The related data shows what was available at the time of investigation. You can refresh this data manually using the **Refresh** button. ### Related Data Insights Tab The **Related Data Insights** tab shows answers to supplemental investigative questions based on the Related Data. These Related Data Insights help a SOC analyst interpret the significance of the related data more quickly. For example, customers with the [Zscaler OneAPI integration](/doc/docs/integrate-zscaler-oneapi-with-red-canary) will see insights about any unusual or risky circumstances detected in their linked ZIA activity and, if relevant, whether or not the activity was blocked by Zscaler. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/investigations_10.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) For customers with the Zscaler OneAPI integration, a list of possible insights can be found in the Zscaler OneAPI integration [FAQs](/doc/docs/integrate-zscaler-oneapi-with-red-canary#faq). ## Filtering Investigations In addition to sorting the summary data on the top level **Investigations** page, you can also use the search function to filter the list. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/investigations_11.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) ### Using the Search Box To manually build a filter: 1. Enter your filter attributes in the **Search with filters** box. Note that you can click on the example searches in the UI to copy the text as a template. 2. Press **Enter** to apply the filter. > [!NOTE] > **Note:** Multiple attributes are applied with the AND logical operator, so each attribute further narrows the filter. The following filter attributes are available: | **Attribute Name** | **Description** | **Example** | | --- | --- | --- | | *Keywords* | Plain keyword filtering (with no attribute specified) works against certain text fields in the Investigation, for example identity and endpoint names. Unlike the defined attributes filters, keywords match on partial values. | `admin` `test.user` | | ID | Filter by Investigation ID (omit the # character) | `id:123` | | Endpoint | Filter by the current hostname, the sensor ID, or the Zscaler MDR ID of the endpoint. | `endpoint:admin-pc` `endpoint:2000000001` `endpoint:123` | | Identity | Filter by the username, UID, or Zscaler MDR ID of the endpoint. | `identity:test.user` `identity:S-1-5-3` `identity:123` | | Result | Filter events by the result. Possible values are: `investigation` `no_threat_observed` `confirmed_threat` | `result:no_threat_observed` | | Last Update | Filter by the date activity was last seen on this investigation. | `last_update:2025-09-21..` | | Originating Activity At | Filter by the date of the originating activity for this Investigation | `originating_activity_at:2025-09-21..` | | *Reporting Tags* | Filter by the "key":"value" reporting tags currently applied to an endpoint. Keys or tags with a space must be wrapped in double quotes, for example `"Business Unit"` | `endpoint_type:workstation` `"Business Unit":"Headquarters"` `"Business Unit":*` (endpoints with this tag) `"Business Unit":!` (endpoints without this tag) | | Investigative Lead | Filter by the investigative lead that is associated with an Investigation | `investigative_lead:123` | | Detection Analytic | Filter investigations by detection analytics | `detection_analytic:WIN-16HEX-EXE` | | Resulting Threats | Filter investigations by resulting threats. The `THREAT-` prefix is optional and you can use `\|` to match multiple values. | `resulting_threats:THREAT-123` `resulting_threats:123\|456` | **Case Matching** All filter attribute matches are case-insensitive. **Dates/Times** Date-based attributes are specified using `from..to` syntax, where `from` and `to` are date-times or ISO 8601 dates. You can omit either `from` or `to` to filter for unbounded times. For example: - `2025-01-01..` matches on or after (>=) the from date - `..2025-01-01` matches on or before (<= the to date - `2025-01-01..2025-01-31` matches on or after (>=) the from date and on or before (<=) the to date ### Using the Filter Icon As an alternative to entering attributes manually in the **Search with filters** box, you can use the UI to create your filter attributes. 1. Click the filter icon ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/filter_icon.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) to show available options. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/investigations_12.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A35Z&se=2026-11-04T16%3A09%3A35Z&sr=c&sp=r&sig=W4KAGQeTqSMmpvHU7s%2FN4XMjPjz9pRvs8CWPhyUSkJI%3D) 2. Use the dropdowns and text boxes to define the filters. 3. Click **Apply Filters** to build the filter string and apply it.