Lean how to investigate and manage your incidents.
On the Incident view you can track incidents, investigate incident details, and take remedial action. Navigate to → and locate the incident you want to investigate.
Note
If you do not have permissions to access an asset of an incident (which is shown as grayed out and locked), check your scoping permissions in Manage Users or Manage User Groups.
Click on an incident to open the incident in the right panel. In the incident header you can update various data, such as the severity, incident name, score, and merge incidents.
Change the incident severity.
The default severity is based on the highest alert in the incident. To manually change the severity select the severity tag and choose the new severity.
Add or edit the incident name.
Edit the incident description.
Hover over the incident description and select the pencil icon to edit the incident description.
Update the incident score.
Click on the assigned score to investigate how the score was calculated.
In the Manage Incident Score dialog displays all rules that contributed to the incident total score, including rules that have been deleted. Deleted scores appear with a N/A.
You can override the Rule based score by selecting Set score manually or change the scoring method. For more information, see Incident scoring.
Assign an incident.
Select the assignee (or Unassigned) and begin typing the assignee’s email address for automated suggestions. Users must have logged in to the app to appear in the auto-generated list.
Assign an incident status.
Select the incident Status to update the status to either New, Under Investigation, or Resolved. By updating the status you can indicate which incidents have been reviewed and to filter by status in the incidents table.
When setting an incident to Resolved, select the reason the resolution was resolved, add an optional comment, and select whether to Mark all alerts as resolved. For more information, see Resolution reasons for incidents and alerts.
Merge incidents you think belong together. Click the more options icon and select Merge Incidents.
Create an exclusion.
Review the remediation suggestions. Click the more options icon to open the Remediation Suggestions dialog.
Review the incident assets.
Review the number of alerts, alert sources, hosts, users, and wildfire hits associated with the incident. Select Hosts, Users, and Wildfire Hits to display the asset details.
Track and share your investigation progress.
Add notes or comments to track your investigative steps and any remedial actions taken.
Select the Incident Notepad (
) to add and edit the incident notes. You can use notes to add code snippets to the incident or add a general description of the threat.Use the Incident Messenger (
) to coordinate the investigation between analysts and track the progress of the investigation. Select the comments to view or manage comments.If needed, Search to find specific words or phrases in Notepad and Messenger.