Recently, information security incidents happened frequently, and endpoint security protection has become the last line of defense. EDR has become an important part of many enterprise's information security protection architect. However, after deploying the EDR solution, how to analyze and investigate information security alarm events has become a concern of many users. In this agenda, we will share with you how FortiEDR can be use for information security incident investigation and analysis and case sharing of FortiMDR security incident handling.