Review the timeline and affected assets to understand the scope of the alert.
Select an investigation row to open the quick-view side pane. Alternatively, select the entry in the Details column to open the investigation details page.
Review the Timeline to understand the sequence of activity associated with the alert. The timeline provides a graphical, hierarchical view of the attack chain, including the hosts, identities, and artifacts mapped by the Investigation Agent.
Review the Assets to identify the users, hosts, and IP addresses involved in the investigation.