New Investigation Page
The New Investigation page within the Investigations interface lets you run queries on available data with desired filters for a specific timeframe.

To generate a new investigation report, configure the filters as desired and set the timeframe. See the Filters Section topic for additional information.
Then click Run Query. The report data appears in the sections following the Filters section. See the Investigation Reports topic for additional information.
If you run a query without applying filters, the report sections display all activity by all users for the designated timeframe, which is set by default to Last Hour.
The report generated by a new investigation can be exported. The Schedule Export option isn't available from the New Investigation page. See the Export Report topic for additional information.
The Save option lets you save your configured filters to run the investigation again later.
Save an Investigation
To retain filter configuration after running a query and confirming the report you want data is displayed, save an investigation.
This option is available only to users with the Administrator or the Response Managers roles.
Step 1 – On the New Investigation page, click Save in the upper right corner. The Save Investigation window opens.
Step 2 – Enter a unique, descriptive name for this investigation in the Name field.
Step 3 – Enter a report description in the Description field.
Step 4 – From the Folder dropdown menu, select the folder where you want to save the investigation. The My Investigations folder is the default for custom investigations.
Step 5 – Select a user role from the Owner dropdown menu. All users assigned this role own this investigation and can modify the report.
Step 6 – In the Access box, type to search the user role you want to give access of this investigation. A list of user roles matching the search string appears. Select a single or multiple user roles. All users belonging to the selected roles can view the report.
Step 7 – Click Save. The Save Investigation window closes.
The investigation is saved to the selected folder, and the folder expands in the navigation pane to display the saved item. Users can open this folder from the navigation pane to access the investigation. They can run the investigation, schedule exports, or add subscriptions.
See the Investigation Options topic for additional information.