Question 1

What is centralized investigation?

Accepted Answer

A workflow where analysts query a single source of truth for logs across devices and tenants, correlating events faster with fewer blind spots.

Question 2

How does correlation work in practice?

Accepted Answer

Advanced correlation is on our roadmap. Today you can filter and search across sources and time ranges to investigate manually.

Question 3

Can non-security teams benefit too?

Accepted Answer

Yes. Operations, networking, and application teams can use centralized logs for troubleshooting and performance insights.

Question 4

What about role-based access?

Accepted Answer

Access controls help limit visibility based on roles and responsibilities.

Question 5

How do I preserve evidence?

Accepted Answer

You can export logs and rely on the default 12‑month retention to keep data available.

Question 6

Does this integrate with alerting?

Accepted Answer

Alerting is not yet available. It is planned on our roadmap.

Centralized Investigation

FAQ