How can an individual asset action be manually started?

• A. With the > action button in the analyst queue page.
• B. By executing a playbook in the Playbooks section.
• C. With the > action button in the Investigation page.
• D. With the > asset button in the asset configuration section.

Answer: (C)

An individual asset action can be manually started from the Investigation page by using the designated action button. This is the primary way to interact with specific assets during an investigation, allowing analysts to initiate actions relevant to the asset currently under consideration. The Investigation page serves as a centralized location where analysts can gather context, view related incidents, and take decisive actions on specific assets without needing to navigate away from the primary workflow.

Starting actions from other locations, such as the Analyst Queue or the Playbooks section, typically involves batch processing or predefined automated workflows rather than initiating a singular action directed at a specific asset. The asset configuration section would focus more on configuring asset properties and settings rather than executing immediate actions against those assets.