Investigating from the Falcon Console

The panel renders in Falcon's detail flyouts, not full-page record views. See the app overview for the full list of surfaces.

The Entity Picker

The app reads the record and offers its entities — accounts, hostnames, IP addresses — as chips. It reads the structure of the record rather than field names, so an account is recognized whether a product calls it user_name, upn, or name inside a user object.

When No Entity Is Detected

Some records identify a selection only by an internal id — selecting an IP node in a case Workbench gives the app a node identifier, not the address.

The panel then offers a field to enter an entity yourself. It behaves exactly like a detected one. The kind is inferred from the value: an IPv4 address as an IP, a value containing @ as an email, with a selector for anything ambiguous.

Worker Investigation

Shows the agentic investigation for this record, or starts one.

Record context. The detection's details — command line, file paths, hashes, MITRE mapping, device — are attached to the investigation by default, so the Worker investigates this detection rather than a bare entity name. A checkbox turns this off and states the size. The attached text is shown at the bottom of the panel.

Earlier runs. Where a record has more than one investigation, the newest is shown and a selector gives access to the others.

See Auto-Investigating Detections for the automatic path.

Federated Search

Pick a time range — 1 hour by default, with 6h and 24h — and run the search. The app builds the statement:

QUERY ** WITH %username = 'jdoe' SINCE 1h LIMIT 10

The % selector searches every field mapped to that entity across every connected source, so one product putting the account at actor.user.email_addr and another at user.name both match.

Each row shows the time, entities, severity, event class, and source platform, with a summary of the platforms that contributed.

A link below the results opens the same search in the Query console with no row cap or time ceiling.

If a Search Times Out

Searches from the panel must finish within 30 seconds.

Narrow the window first — it is the strongest lever for an entity-pinned search. Lowering the row limit rarely helps: a LIMIT only shortens a search where matches are plentiful, and a sparse window has nothing to return early. For open-ended work, use the Query console link.

What's Next

• Running Federated Search from Fusion SOAR