Investigate a user - Investigate user assets associated with your cases. - Administrator Guide - Cortex CLOUD

• Case Breakdown: Open cases withing the selected timeframe, with a breakdown of how many cases were opened within each risk severity. Click the different severities to filter the rest of the page to display only the information relevant to that severity level.

• Mitre Att&ck Overview: Mitre Att&ck tactics and techniques detected for the user.

• User Risk Score Trend: The graph is based on new cases created within the selected time frame, and updates on past cases that are still active. The straight line represents the user score, which is based on the scores of the cases associated with the user.

  The bubbles in the graph represent the number of issues and insights generated on the selected day. Bigger bubbles indicate more issues and insights, and a possible risk.

  Drill down on a score for a specific day by clicking a bubble. Alternatively, review the user information for the selected timeframe (Last 7D, 30D, or custom timeframe).

  For users with associated asset roles, compare the data with other peers with the same asset role. In the Risk Score Trend graph click Compare To and select an asset role to which you want to compare the data.

  The dashed line presents the average score for peers with the same asset role as the user, over the same time period. Hover over a bubble on the dashed line to see the Average score for the selected peer and a breakdown of the score per endpoint. Click Show x Users to see a full breakdown of the score on the Peer Score Breakdown, filtered by the selected asset role. From the Peer Score Breakdown, you can select any user name and pivot to additional views for further investigation.

• User Cases: Related cases triggered for the user for the selected timeframe or severity selected in the Case Breakdown widget. If you are drilling down on a score, you can see the cases that contributed to the total score on the selected day. Review the following data:

  • The Status column provides visibility into the reason for the score change. For example, if a case is resolved, its score will decrease, bringing down the user score.

• Issues & Insights: All detection activities associated with the user. The issues are grouped into buckets according to MITRE ATT&CK tactics. Click on a tactic to filter the issues in the table. To further investigate an issue, click the issue to open the Issue Panel and click Investigate.

• Mitre Att&ck Matrix Breakdown: Detailed information about the Mitre Att&ck tactics and techniques detected. Click Open Mitre Triage to remediate the threat.

Highlights

• Common User Locations: A breakdown of the countries from which the user connected in the past few weeks.

• Common Operating Systems: A breakdown of the operating systems that the user used to connect in the past few weeks.

• Failed Logins: Details about failed login attempts by this user.

• Activity Timeline: Consolidated timeline view aggregating the activities of the user from different sources like Auth, Cloud, Endpoint into a single chronological stream. Displays the volume and type of activities over the selected time period.

  The list provides a detailed, chronologically ordered timeline of individual events. Each event includes its timestamp, description, event type, and data source icon.

• Issues & Insights Heatmap: Grid visualizing the volume and density of user activity across specific times of the day and days of the week. It aggregates events to show when a user is most active versus when they are inactive.

  The widget compares the user's actual activity data with their regular activity hours and highlights any differences or anomalies in the user's expected activity.

  The cells are marked according to the activity that took place, and a dashed frame indicates that Cortex Cloud detected uncommon activity in the time slot.

  • A dashed ribbon highlights discrepancies between regular activity hours and actual activity.

  • A colored ribbon indicates the level of activity on a specific day/hour.

  • A numbered ribbon indicates the number of issues and insights that occurred on a specific day/hour.

• Login Attempts: Details of the user's login attempts and whether the attempts were successful. To further investigate login activity for the user, click View In XQL to link to a prefilled query in the Query Builder. Using Cortex Query Language you can create queries to refine your search.

• Authentication Attempts: User's latest authentication attempts during the selected timeframe. You can see details of the related authentication attempts, and whether the attempts were successful. To further investigate authentication attempts by the user, click View In XQL to link to a prefilled query in the Query Builder. Using Cortex Query Language you can create queries to refine your search.

• SaaS Logs: User's SAAS Log activity during the selected timeframe or on the day selected in the Score Trend graph. You can see details of the SaaS logs that were ingested into the platform in the context of the user.

  To further investigate SaaS log activity for the user, click View In XQL to link to a prefilled query in the Query Builder. Using Cortex Query Language you can refine your search.