View the original SIEM data in a case

Supported in:

To view the original SIEM data in a case:

  1. Drill down to the required case.
  2. Click the Overview tab. The Overview tab shows you the alerts, their timeline, extracted entities and insights that were collected by automation.

To see the original event that generated the alerts:

  1. Go to the Events tab.
  2. Click View More. A side drawer opens with all details associated with the event.
    3. viewsiemdataincase

Need more help? Get answers from Community members and Google SecOps professionals.