Create a new investigation

Create a forensic investigation, assign access, and start a data collection.

Create a forensic investigation to group data collections, alerts, and evidence for a single case.

1. Go to Investigation & Response → Forensics.
2. Select New Investigation.
3. Enter an investigation name and optional description.
4. In Permissions, select users who can access the investigation data.

To assign investigation permissions, enable Scope-Based Access Control (SBAC). See User permissions.

1. Select Save to create the investigation.
2. Select Save & Start a Collection to add data immediately.
3. In New Collection, select Hunting or Triage.
4. Configure the time zone and timestamp format from UTC Timezone, if needed. See Configure server settings.

---