Investigate a device
Everything FirstSI knows about an IP address or a workstation name, on a single page.
Enter an IP address or a workstation name, pick the period (1 h, 6 h, 24 h, 7 days), then click Investigate. The page brings together what every module knows about the device:
| Block | Content |
|---|---|
| FirstSI agent | The machine, its agent, its last activity |
| Network device, UniFi client | The inventoried device, the access point and Wi-Fi site where it is seen |
| NetDiag | Its verdicts over the period |
| Destinations, Countries, Services | Who it talks to |
| Firewall | The firewall logs that concern it |
| Matches with malicious addresses | Contacts with addresses on threat lists |
| DNS queries | The names it looked up |
Open in the flow explorer carries the device over as a filter into the Flow explorer. Recent: keeps your last 5 searches.
When a security alert points at an address, this is the page to start with: you see straight away whether it is a known workstation, who uses it and what it contacted.
Source: · FirstSI Docs · updated 2026-10-10