Understanding investigation canvas actions

This section describes the various actions that you can perform on the investigation canvas.

Investigation canvas includes:

1. Form actions
2. Graph actions
3. Node actions
4. Edge actions
5. Map actions

Figure 1. Investigation Canvas

Table 1. Investigation canvas Form actions

Action	Operation
Link Case	Allows to link cases on the investigation canvas.
Unlink Case	Allows you to unlink the cases on the investigation canvas.
Duplicate	Option to duplicate the nodes on the investigation canvas.

Table 2. Investigation canvas Graph actions

Action	Operation
Save Canvas	Allows you to save the investigation canvas.
Add Data to Library	Allows you to create new relationship between two different nodes.
Add From Library	Creates new relationships and threat entities in the threat intelligence library if the newly added nodes and edges in the canvas are not already part of the library.
Add From Case Artifacts	Allows you to add data from corresponding case artifacts that is linked to the canvas.

Table 3. Investigation canvas Node actions

Action	Operation
Mark as Home Node	Option to mark that specific node as a home node.
Add Relationship	Option that allows you to add various object relationships. You can add one to many or many to one or many to many node relationships.
Show Details	Option that shows details of that specific node.
Open Record	Option that allows you to open the record in a new tab.
Remove from Canvas	Option that allows you to remove the node from the canvas.
Fetch Related Records	Option that allows you to fetch the related records for that specific node.

Table 4. Investigation canvas Edge actions

Action	Operation
Edit	Allows to link cases on the investigation canvas.
Remove	Allows you to unlink the cases on the investigation canvas.

Table 5. Investigation canvas Map actions

Action	Operation
Zoom in	Option to zoom in the investigation canvas to easily focus on specific areas of the canvas.
Zoom out	Option to zoom out the investigation canvas to easily focus on specific areas of the canvas.
Fit to screen	Option to fit the investigation canvas to the screen size.
Export map	Option to export the investigation canvas as a PDF for better viewing.
Refresh	Option to refresh the investigation canvas data.
Switch to unified vertical layout	Option to switch the investigation canvas view to unified vertical layout to enhance the clarity between the nodes.
Switch to unified force layout	Option to switch the investigation canvas view to unified force layout to enhance the visualization of complex relationships between the nodes.