To add an origin or impacted Host from a log to an entity as a known Host
- After running an Investigation or SecondLook search, select a log in the search results grid.
- Right-click the selection, and then select Add Origin Host as Known Host or Add Impacted Host as Known Host.
The Select Entity dialog box appears.
- Select the entity where you want to add the Host.
The Host window appears.
- Enter or update information if necessary. For more information, see . Manually
- Click OK.