Quick triage is useful when you receive an alert with very little context. A single IP address can still serve as a good investigation pivot. Logmanager makes this practical by allowing fast searching, column customization, and smooth expansion from one clue to a wider set of related events.

Discover search screen in Logmanager used to investigate a suspicious IP address
Fig. 1: Discover search screen in Logmanager used to investigate a suspicious IP address.

1. Search in Discover

Open Discover and search for the suspicious IP address from the alert. Extend the time interval beyond the exact alert time so you can see what happened before and after the triggering event.

2. Add Context Columns

Add useful fields such as username, event type, and source device. This is helpful because it lets you understand the context of each event without opening every row one by one.

Discover results in Logmanager with added username event type and device columns for suspicious IP analysis
Fig. 2: Discover results in Logmanager with added username event type and device columns for suspicious IP analysis.

3. Look for Failed and Successful Events

Review the timeline for failed logins, probing behavior, and later successful or application-related events. A sequence of failed attempts followed by valid activity can indicate escalating risk.

Suspicious IP event stream in Logmanager showing failed login attempts and other related activity
Fig.3: Suspicious IP event stream in Logmanager showing failed login attempts and other related activity.

If multiple usernames or source systems appear in connection with the same IP address, continue by reviewing those users, other associated IPs, and any unusual access or privilege activity connected to them.