Run Reports as Investigations

 Only Global Admins or Restricted Admins with elevated View and Manage privileges can take this action.

You can run existing Reports as an Investigation, utilizing the search type, date range, log source selection, and other options that are already configured for the Report. You can modify any of the configured options in the Investigator Wizard, just as you can when running a normal Investigation. You can only run a Report as an Investigation if it was created from the Log Summary Report, Log Detail Report, or Executive Report template. Reports created from the Alarm and Response Report, Audit Log Report, or Log Management Statistics Report template cannot be run as Investigations. The option to run a Report as an Investigation is not available if the Report was created from an unsupported template types.

To run a Report as an Investigation

1. On the Tools menu, click Report, and then click Report Center.
2. Click the Reports tab.
3. Select the Action check box for one of the supported Report types.
4. Right-click anywhere in the grid, and then click Run as Investigation.
   The LogRhythm Investigator Wizard appears.

5. Configure the options in the Wizard to review or modify the Investigation settings. For more information on the Wizard options, refer to Create Investigations.

6. On the last page of the Wizard, do one of the following:

   1. To save the Investigation, click Save.

   2. To export the Investigation to a file, click Export.

   3. To launch the investigation, click Next or Launch.