---
sourceDocument: Xanadu Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/security-management

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Working with Investigation Canvases

# Working with Investigation Canvases {#ariaid-title1}

* Release version: Xanadu
* 
* Updated October 30, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The Investigation Canvas is a key significant feature which provides more valuable information for the Threat Intelligence (TI) analysts. It provides a structured framework by mapping one to one or one to many relationships and
visualizing information related to observables, indicators of compromise (IOCs), or entities.  
By using the investigation canvas, threat analysts can effectively:

* Map Relationships: Visualize node connections between different entities such as observables, indicators of compromise (IOCs), threat actors, attack patterns, affected assets and so on.
* Link cases or canvases: Link a case or canvas to enhance the analysis and provide a more comprehensive view of the threat landscape within the case management.
  * The linking feature enables analysts dynamically add or remove nodes. This also populates the existing relationships between the nodes to the canvas.
  * Temporary Relationship graphs by saving relationships separately within the context of the Investigation Canvas.
  {#tisc-investigation-canvases__ul_c31_1x5_gdc}
* MITRE technique associations: Associate or remove MITRE techniques with nodes directly on the canvas and provide analysis on the MITRE kill chain card.
{#tisc-investigation-canvases__ul_thp_l55_gdc}

## Entry Points for the investigation canvas {#tisc-investigation-canvases__section_cwd_my5_gdc}

1. First entry point: New Blank Canvas: This entry point should allow the analysts to open a new and blank canvas without any nodes or links.
2. Second Entry Point: Open Canvas in Case Investigation:
   1. This entry point opens an existing investigation case and allows to edit, modify, and rename the canvas.
   2. A new canvas with existing artifacts as nodes.
   {#tisc-investigation-canvases__ol_oyw_qy5_gdc}
{#tisc-investigation-canvases__ol_vqj_qy5_gdc}
* **[Understanding investigation canvas actions](https://www.servicenow.com/docs/OQWZGov_kcqQ5TjbioRccg)**   
  This section describes the various actions that you can perform on the investigation canvas.
* **[Linking an existing case from Investigation Canvas](https://www.servicenow.com/docs/cP8yJzJvNJpqzG1nrdEt4Q)**   
  Use this section to link an existing case from the investigation canvas.
* **[Creating a Case and Linking from Investigation Canvas](https://www.servicenow.com/docs/DSQOHeX3t78xFSaJISuf9A)**   
  Use this section to create and link a case(s) from an investigation canvas.
* **[Linking Canvas from a Case](https://www.servicenow.com/docs/3shFMb00E~RZ_EgtKIJ2xA)**   
  Use this section to link a canvas from a case.
* **[Create an investigation canvas](https://www.servicenow.com/docs/jjaynG5sxtfw9vfeIVMdhA)**   
  Create a new canvas to add observables from threat intelligence library.
* **[Adding a new node to the canvas](https://www.servicenow.com/docs/suL4gjziG_NSMfVQO1xjKw)**   
  Use this section to create and add new entities, including observables or objects, directly from the investigation canvas.
* **[Investigation canvas and MITRE ATT\&CK](https://www.servicenow.com/docs/_mx8yZ_Wt18ziiPFYnVPCw)**   
  In the investigation canvas, view the MITRE ATT\&CK techniques and sub-techniques which are associated to all the nodes in the canvas.

**Related concepts**   

* [Workbench Overview](https://www.servicenow.com/docs/8wBiOmzIK6FpCl1IMQWAOg "The Workbench Overview page consists of the Case Tasks and Cases that are under Threat Analysts and their team.")  
**Related tasks**   

* [Creating cases using Threat Analyst Workbench](https://www.servicenow.com/docs/qPT9Qu_WSDmTPyh5zCmv2Q "Cases are used to track information about a campaign or threat actor threatening your organization. After a case is created, you can add artifacts that allow you to review and analyze all related information from a single case or case task.")
* [Create case task using Threat Analyst Workbench](https://www.servicenow.com/docs/OTnKXCYm2OSxYhF2QcAPZQ "Create case tasks to associate with case(s).")
* [Add artifacts to case(s) or case task(s)](https://www.servicenow.com/docs/lMV2EV~g0o5pnF~I6CafwA "After you have created a case, you can view or add artifacts, such as security incidents, CIs, and indicators of compromise, to the case. These artifacts act as clues in solving the case.")
* [Run Enrichment Actions within a case](https://www.servicenow.com/docs/Pgpc2Zo6qZDqLvNqRr2ZBg "Use this section to understand how enrichments actions are performed on case(s).")
* [View Case Reports](https://www.servicenow.com/docs/nV41CotG3rokyBmpw349HQ "Use the case reports feature to generate reports related to the cases. These reports include post investigation report or an executive summary report.")
* [Create a security incident from a TISC case](https://www.servicenow.com/docs/KhTBPf9Elr1qyrbtskKF0g "Create security incidents and associate observables to the security incidents from a TISC case.")
* [Upload Secure File Attachments](https://www.servicenow.com/docs/22i0_04KTbMK1~UdaaD9HA "Use this section to understand on how to upload the secure file attachments to the case(s).")