Assisted Investigations

Assisted investigations make it easier for an analyst to search for information about an indicator in the data lake. This tool has the advantage of not requiring knowledge of SQL or the database schema that
Cytomic Orion uses to store the telemetry gathered from user computers.

An assisted investigation works in a similar way to that of a setup wizard: the process involves a series of searches, which in turn depend on the results generated in the previous steps. As analysts progress through the process, the investigation reveals new searches that enable them to navigate the data lake naturally, as if it were a conversation.