[Yandex Cloud documentation](../../../index.md) > [Yandex SIEM](../../index.md) > [Step-by-step guides](../index.md) > [Investigations](index.md) > Investigation management

# Investigation management

{% note info %}

This feature is in the [Preview](../../../overview/concepts/launch-stages.md) stage. To get access, contact [tech support](https://center.yandex.cloud/support) or your account manager.

{% endnote %}

This section describes how to create investigations, manage their settings, and perform basic operations with them.

## Getting started {#before-you-begin}

The Yandex SIEM section will appear in the Cloud Center interface as a Security Deck module after the access request is approved.

You need the `ycem.editor` [role](../../../iam/roles-reference.md#ycdr-admin) to use the service.

## Creating an investigation {#create}

To create an investigation:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Go to [Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select **Yandex SIEM**.
  1. Navigate to the **Investigations** tab.
  1. Click **New investigation**.
  1. Enter a name for your investigation in the header field.
  1. Under **Description**, add a description for your investigation.

  {% note tip %}

  Use clear names that reflect the investigation objective, e.g., `Failed login analysis for February` or `Prod cluster suspicious activity`.

  {% endnote %}

{% endlist %}

## Updating an investigation {#edit}

### Renaming an investigation {#rename}

To rename an investigation:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Open an investigation.
  1. At the top of the page, click the investigation name.
  1. Enter a new name.
  1. Press **Enter** or click outside the input field.

{% endlist %}

### Editing a description {#edit-description}

To edit an investigation description:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Open an investigation.
  1. Under **Information**, click the **Description** field.
  1. Enter a new description.
  1. Press **Enter** or click outside the input field.

{% endlist %}


## Copying an investigation {#copy}

To create an investigation copy:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Open an investigation.
  1. In the actions menu, select **Create copy**.
  1. Wait until the copy is created.

  The copy inherits all requests and settings of the original investigation.

{% endlist %}

## Deleting an investigation {#delete}

To delete an investigation:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Open an investigation.
  1. In the actions menu, select **Delete**.
  1. Confirm the deletion.

  {% note warning %}

  Deleting an investigation is irreversible. All requests and results will be deleted.

  {% endnote %}

{% endlist %}

#### Useful links {#see-also}

* [Investigations](../../concepts/investigations.md)
* [Queries](../../concepts/queries.md)
* [Working with the investigations list](investigations-list.md)
* [Working with queries](../queries/index.md)