Investigations

You can use the Investigations tab to manage the investigations created in the Analysis section of the Monitoring Center.

Investigations actions

You can access investigation actions by right-clicking an investigation table row or by clicking the three dots icon at the end of the row. Some actions are also available as buttons above the table. They operate on multiple selected investigations, so you must first select some table rows (in the leftmost column) before these bulk actions become active.

These are the possible actions for investigations in Flowmon Dashboards and Reports (FMD) > Investigations:

• Open - Opens the investigation in Monitoring Center Analysis. The Open option is only available by right-clicking the table or by clicking the three dots icon at the end of the row.
• Edit - Edit the name and description. You can also specify whether the investigation is private or shared with all users in a given tenant.
• Duplicate - Make a copy of the investigation. You can change the name and description. You can also specify whether the investigation is private or shared with all users in a given tenant.
• Import - Import a previously-exported investigation.
• Export - Export the investigation in JSON format. Bulk export is also possible.
• Delete - Delete the investigation permanently. Bulk delete is also possible.

In the unsaved investigations table (which you can access by clicking Show unsaved only in the top-right corner) you can only:

• Delete the investigation.
• Open the investigation in Monitoring Center Analysis.
• Save the investigation.

Playbook management

You can also use the Investigations tab to manage playbooks. Playbooks are reusable investigation templates that you can create by saving an investigation.

You can use Open playbook to create a new investigation using the playbook as a template. The investigation is a standalone copy and does not maintain a reference to the source playbook.

For details on creating and using playbooks, refer to Playbooks.

For details on automating playbook execution, refer to Automations.

For further details, refer to the following page: Description of the unsaved and saved investigation.