Monitoring and Investigation Flashcards
1
Q
Where are attachments to investigations stored?
A
KV Store
2
Q
What are the different components of the Investigations page that stores information in KV Stores?
A
- Investigations
- Items added to the investigation
- Attachments added to notes on the investigation
- Artifacts added to the investigation workbench
Each is stored in its own collection.
3
Q
Who can delete an investigation?
A
ess_admin users only
4
Q
How is notable event urgency calculated?
A
Severity + Priority
Severity is set by the correlation search.
Priority is assigned to the asset or identity.
