Getting Evidence from Investigation in InsightConnect

[kcohne]

Any feedback, in another thread you mention searching logs for Alerts or using global artifacts to get this information, can you expand on this as I can’t seem to find any logs that hold this info, as this seems to come straight from the agents.

Is there a way to get the evidence from the alerts inside an investigation from a workflow?

I am trying to cut some time off on closing false positives, by creating a workflow that can automatically repeat the proccess of closure. But i need to be able to analyse each case and allow or not the procedure, for that i use a human decision step. But there is no information regarding the specifics of the alert the investigation is based on and i haven’t found anyway to get the evidence from said alert. I’ve tried creating a custom alert workflow, but the problem is basically the same but …