Introduction

AROs are built with simplicity in mind, so we omit supplemental insights and raw data from AROs by default. But, enabling supplemental insights and raw data for AROs, you can access more technical content generated by our analysts while investigating and generating the ARO.

We omit these sections by default since they do not impact the intrinsic value of an ARO; you will still be able to understand and action any ARO issued to you, regardless of this supplemental content.

This article explains how to enable supplemental insights and data, as well as provide examples of each.

Enabling Supplemental Insights & Raw Data

To enable this feature and view supplemental insights & raw data for your organization’s AROs, navigate to the Data Management page (Administration section) in the sidebar. From the page’s ARO Insights section, enable the supplemental content you want to view in AROs.

Supplemental Insights

An ARO’s supplemental insights includes data that analysts used while investigating and generating the ARO. This data is usually taken directly from your organization’s telemetry. After enabling the feature, AROs will include a supplemental insights section on the AROs page and show insights when applicable.

Examples of supplemental insights include:

• The location(s) a user has authenticated from.
• The device(s) has a user authenticated from.
• The Internet Service Partner (IPS) a user used, relating to the ARO.

The example below shows ARO insights from an ARO related a user logging in from a suspicious location, and every insight is expanded.

Supplemental Raw Data

When enabled, an ARO’s supplemental raw data section contains a zip file that bundles the ARO’s supplemental insights into a downloadable package. Click Download file to download the package.