> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/detect-and-respond/investigate.md).
# Investigate
Search, chart and explore your security events in one place with Investigate, the CybaOps SIEM.
*Search and explore your security events*
**Investigate** is the part of CybaOps where you can search through everything your security tools have recorded. It works like a search engine for your security data. You can look for events, spot patterns and save the searches you use most.
### What is Investigate?
Investigate is our **SIEM**. SIEM stands for **Security Information and Event Management**. In plain English, it is a tool that collects records of what has happened across your systems and lets you search them.
Each record is called an **event**. An event might be a user signing in, a program starting or a file being changed. Every event is made up of **fields**, such as the activity name, the time or the device name. CybaOps converts every event into one shared format called **OCSF** (Open Cybersecurity Schema Framework), so the same field names work across all your sources. See [Writing Queries](/detect-and-respond/investigate/writing-queries.md#how-your-data-is-organised-ocsf). To see where your data comes from and how it's converted, see [How Data Gets into CybaOps](/detect-and-respond/investigate/how-data-gets-into-cybaops.md).
With Investigate you can:
* search for events using simple queries, or ask **Sentry AI** to write the query for you
* see your results as a list, a table, a time chart or a pie chart
* save searches so you and your team can reuse them
* build dashboards that show the information you care about at a glance
* look into an incident using the details already recorded on the case
{% hint style="info" %}
You do not need to be a cyber security expert to use Investigate. Start with the [Your First Search](#your-first-search) steps below, then explore the guides at the bottom of this page.
{% endhint %}
***
## A Tour of the Screen
Investigate has two main views, which you can switch between at the top of the page:
* **Explorer** – where you search for events and look at the results
* **Dashboards** – where you build and view collections of charts and tables
* **Tabs**: Each tab holds its own search, time and source, so you can work on several searches at once.
* **Query bar**: The box that says **Write a query**. This is where you type your search.
* **Source**: Chooses which set of data you search, for example **events** or **mdr**.
* **Star icon**: Saves your search so you can use it again.
* **Time picker**: Chooses the time period to search. The default is the last 15 minutes.
* **Results**: Shows a timeline of matching events, and the events themselves underneath.
***
## Your First Search
This short walkthrough takes about 2 minutes. You will find every event where a program was stopped in the last 24 hours.
### Before you start
* You need a CybaOps account with access to Investigate.
* Your organisation needs at least one data source connected.
{% stepper %}
{% step %}
### Open Investigate
1. Sign in to the CybaOps portal.
2. In the menu, select **Investigate**.
3. Make sure **Explorer** is selected at the top.
{% endstep %}
{% step %}
### Choose your source and time
1. Click the **source** button next to the query bar and choose **mdr**.
2. Click the **time picker** and select **Last 24 hours**.
{% endstep %}
{% step %}
### Write your query
1. Click in the box that says **Write a query**.
2. Type the following:
{% code overflow="wrap" %}
```
activity_name = "Terminate"
```
{% endcode %}
{% endstep %}
{% step %}
### Run the search
1. Press **Enter**, or click the **search** button.
2. Your results appear underneath. The bar chart shows when the events happened.
{% endstep %}
{% endstepper %}
{% hint style="warning" %}
**Always search on a field.** Typing a word on its own, such as `Terminate`, will not find anything. Use the pattern `field = "value"` instead.
{% endhint %}
Your results are listed newest first. To read them from oldest to newest, see [Sorting Results](/detect-and-respond/investigate/sorting-results.md).
If you get stuck, you can [raise a support ticket](/support/raise-a-support-ticket.md) with us.
***
## Next steps
* [Searching and Results](/detect-and-respond/investigate/searching-and-results.md): Choose a source and time, work with results and save queries.
* [Writing Queries](/detect-and-respond/investigate/writing-queries.md): Learn the query language, autocomplete, shortcuts and Sentry AI.
* [Dashboards](/detect-and-respond/investigate/dashboards.md): Turn searches into charts and tables you can share.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.cybaops.com/detect-and-respond/investigate.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
