Raising an incident
You can raise an incident only from alerts generated for one endpoint.
Incidents can be raised in the following ways:
- In Incidents & Events > Incidents, click Create New in the toolbar. This opens the Create New Incident pane.
- In Incidents & Events > Event Monitor > All Events, right-click an event and select Create New Incident. This opens the Raise Incident pane with the applicable fields filled in, such as the Affected Endpoint.
The following is a description of the options available in the Create New Incident and Raise Incident pane.
|
Option |
Description |
|
|---|---|---|
|
Incident Category |
Select a category from the dropdown list. |
|
|
MITRE Domain |
If applicable, select the MITRE ATT&CK domain that the incident may correspond to. |
|
|
|
MITRE Tech ID |
Select the MITRE ATT&CK technique ID(s) that the incident may correspond to. The incident will be included in count for the MITRE ATT&CK matrix. For more information, see MITRE ATT&CK®. |
|
Severity |
Select a severity level from the dropdown list. |
|
|
Status |
Select a status from the dropdown list. |
|
|
Affected Endpoint |
In the Raise Incident pane, the affected endpoint is filled in and cannot be changed. In the Create New Incident pane, select the affected endpoint from the dropdown list. |
|
|
Description |
If you wish, enter a description. |
|
|
Assigned To |
The admin account to which the incident is assigned. |
|