Within an incident, you can use the Canvas to further explore it and see if any of the indicator relationships provide more information.
Within an incident, navigate to the Canvas tab.
On the Canvas, click your incident.
The Quick View window is displayed.
Navigate to the Indicators tab.
The indicators for this incident are displayed with their current verdict. For example, benign indicators have a green background, malicious indicators have a red background, and unknown indicators have a grey background.
Drag the indicators you want to further investigate on to the canvas.
Hover over an indicator on the canvas and click the blue arrow icon.
A menu with several options appears.
To view the indicator’s relationships, click Expand.
If the indicator has additional relationships, those relationships are added to the canvas.
Click the indicator to view additional information about it and any possible relationships that might exist.