Investigate a host - Investigate host assets associated with your cases - Administrator Guide - Cortex XDR - Cortex - Security Operations

• Case Breakdown: Open cases involving this host within the selected timeframe, with a breakdown of how many cases were opened within each risk severity. Click the different severities to filter the rest of the page to display only the information relevant to that severity level.

• CVEs Breakdown by severity: Summary chart grouping Common Vulnerabilities and Exposures (CVEs) found on this host by severity, highlighting urgent patching needs.

• Mitre Att&ck Overview: Aggregate count of the host's detected behaviors correlated against the MITRE ATT&CK kill chain. The widget highlights the specific tactics and techniques observed in the host's behavior.

• Risk Score Trend: Graph showing the fluctuation of the host's risk score over time, to help identify sudden spikes or long-term high-risk behavior. The graph is based on new cases created within the selected time frame, and updates on past cases that are still active. The straight line represents the host score, which is based on the scores of the cases associated with the host.

  The bubbles in the graph represent the number of issues and insights generated on the selected day. Bigger bubbles indicate more issues and insights, and a possible risk.

  Drill down on a score for a specific day by clicking a bubble. Alternatively, review the host information for the selected timeframe (Last 7D, 30D, or custom timeframe).

  For hosts with associated asset roles, compare the data with other peers with the same asset role. In the Risk Score Trend graph click Compare To and select an asset role to which you want to compare the data.

  The dashed line presents the average score for peers with the same asset role as the host, over the same time period. Hover over a bubble on the dashed line to see the Average score for the selected peer and a breakdown of the score per endpoint. Click Show x Hosts to see a full breakdown of the score on the Peer Score Breakdown, filtered by the selected asset role. From the Peer Score Breakdown, you can select any host name and pivot to additional views for further investigation.

• Cases: Cases triggered for the host for the selected timeframe or severity selected in the Case Breakdown widget. If you are drilling down on a score, you can see the cases that contributed to the total score on the selected day. Review the following data:

  • The Status column provides visibility into the reason for the score change. For example, if a case is resolved, its score will decrease, bringing down the host score.

• Issues & Insights: Comprehensive list of configuration issues, policy violations, or anomalies detected on the host machine. The issues are grouped into buckets according to MITRE ATT&CK tactics. Click a tactic to filter the issues in the table.

  To further investigate an issue, click the issue to open the Issue Panel and click Investigate.

• Related CVEs: Details of the specified CVEs related to the host, correlating device vulnerability with identity risk. This information can help you to access and prioritize security threats on each of the endpoints.

  To further investigate related CVEs, click View In XQL to link to a prefilled query in the Query Builder. Using Cortex Query Language you can create queries to refine your search.

• Mitre Att&ck Matrix Breakdown: Detailed visualization of the Mitre Att&ck tactics and techniques detected on the host. This widget breaks down the attack lifecycle, allowing you to pinpoint exactly which tactics and techniques were employed and identify the progression of the threat.

  Click Open Mitre Triage to remediate the threat.

Highlights

• Failed Logins: Numeric counter displaying the total number of failed login attempts on this host within the currently selected timeframe.

• Login Attempts: All login attempts onto this host. Use the widget to identify lateral movement or unauthorized access.

  To further investigate login activity for the host, click View In XQL to link to a prefilled query in the Query Builder. Using Cortex Query Language you can create queries to refine your search. A table showing all user logins occurring onto this specific host, helping to identify lateral movement or unauthorized access

• Authentication Attempts: Authentication protocols and requests processed by this host during the selected timeframe. You can see authentication. details of the related authentication attempts, and whether the attempts were successful.

  To further investigate authentication attempts by the host, click View In XQL to link to a prefilled query in the Query Builder. Using Cortex Query Language you can create queries to refine your search.