From the Cortex XDR management console, you can view a detailed summary of the behavior that triggered analytics alerts.
Notice
Requires a Cortex XDR Pro license.
The analytics alert view provides a detailed summary of the behavior that triggered an Analytics or Analytics BIOC alert. This view also provides a visual depiction of the behavior and additional information you can use to assess the alert. This includes the endpoint on which the activity was initiated, the user that performed the action, the technique the analytics engine observed, and activity and interactions with other hosts inside or outside of your network.
When enabling Identity Analytics, alerts associated with suspicious user activity such as stolen or misused credentials, lateral movement, credential harvesting, or brute-force data are displayed with a User node.
Similar to the Causality View, the analytics view provides a graphic representation of the activity that triggered the alert and an interactive way to view the chain of behavior for an Analytics alert. You can move the graphic, extend it, and modify it. To adjust the appearance, you can enlarge/shrink the chain for easy viewing using the size controls on the right. You can also move the chain around by selecting and dragging it. To return the chain to its original position and size, click 
in the lower-right of the graph.
Right-click on a node to view additional information.
The activity depicted in the graphic varies depending on the type of alert:
Analytics alerts: You can view a summary of the aggregated activity including the source host, the anomalous activity, connection count, and the destination host. You can also select the host to view any relevant profile information.
Analytics BIOC alerts: You can view the specific event behavior including the causality group owner that initiated the activity and related process nodes. To view the summary of the specific event, you can select the
above the process node.
The following nodes display information unique to the analytics alert view:
User node: Hover over to display the User Information and user Analytics Profile data.
Multi-Event: Displays all the event types associated with the alert in the in the All Events table.