Adding Sandbox Reports to Investigations

You can add sandbox reports to a new or existing investigation. See Investigating Threats in ThreatStream for more information about investigations.

To add a sandbox report to an investigation:

1. Navigate to ThreatStream > Research > Sandbox.
2. Select one or more sandbox reports you want to add to an investigation.

3. Click Start/Continue Investigation.

   

4. Use the search box to find and select an existing investigation or click Create new investigation to start a new one.