Add Agent Computer filter in Investigation Builder

Products Threat Manager Ideas
,
1

What is a one sentence summary of your feature request?

Add Agent Computer filter in Investigation Builder

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

With this we will be search activity on a specific machine. Would also be great for trouble shooting agent issues.

How do you currently solve the challenges you have by not having this feature?

Must search for this in NTP using recent events on a policy, or directly in the NTM db using PGAdmin.

2

Thanks for the submission! This should be possible seeing as it is an exposed field within NTP. We’ll investigate adding this to our schema and exposing it via the investigations interface.