Incidents

Incidents can be created to track and analyze events.

Incidents raised from the Event Monitor contain event details, as well as information and actions helpful for administrator analysis. From the incident's analysis page, administrators can assign, edit, export, or delete incidents, view audit history, and manage attached reports, events, and comments.

Incidents can be viewed at Incidents & Events > Incidents > Incidents.

For more information about incidents, see the following topics:

• Raising an incident
• Managing incidents
• Analyzing an incident
• Configuring incident settings
• Adding reports to an incident

From Incidents & Events > Incidents, you can also review incidents and events according to the MITRE ATT&CK® and MITRE ATT&CK® ICS matrices. For more information, see MITRE ATT&CK®.