The security events detected from logs triaged by SOC analysts and resulted in the alert escalation.

Click on the name of an event to view the event details page.

Customers can retrieve sample event logs for events to help them with the alert investigation. See Getting logs from an event for instructions.

The indicators or signs of compromise that are extracted from the security events. This can include IP addresses, domain names, file hashes, and URLs.

Alert Indicators can include links to enriched FortiGuard data when available. Clicking the link will open the FortiGuard page in a new dialog window, with details about affected products, impact, recommended actions, and more.

Find these links in the alert details, under Correlations > Indicators, and click on the highlighted value of the event to view the FortiGuard Labs data.

The user(s) associated with this alert that are extracted from the security event.

This field will not contain information if the fields related to user privacy have been excluded from logs when configuring FortiAnalyzer log forwarding. If you do not want user information to be included due to privacy concerns or related compliance requirements, please ensure that user identifiable information has been removed from the logs before sending them to SOCaaS. See Sending logs from an on-premise FortiAnalyzer.

Triage artifacts such as raw log and triage reports. This also includes customer attachments that can be added directly in the tab.

Users can share files related to the alert with the Fortinet SOC team by clicking the Add option. PDF, PNG, JPEG, text, and CSV files are supported.

Displays correlated alerts that include the same endpoint(s) that are affected by this alert.

You can click on an alert to view its details. When you click on another alert, the previous alert's ID is displayed in the navigation breadcrumb at the top of the page so that you can easily navigate back to previous alerts. Click the back button to return to the last alert viewed.