Triage results - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2024-12-04
Category
Administrator Guide
Abstract

You can drill down from the triage collection to review the results.

The Triage collection results page displays an overview of the different types of triage collections that were initiated on an endpoint.

The triage results page is divided by the following tabs:

  • Alerts: Refer to Alerts for descriptions of the fields.

  • Artifacts: Display all of the artifact categories collected. You can select the item to add to a timeline.

  • Host Timeline: Displays a list of normalized, per-host timelines that include multiple forensic artifacts in a single table.