Detection details panel

The Detection details panel gives you a closer look at a detection.

From here, you can view:

• the detection's timestamp, severity, risk score, and description
• associated entities and their labels
• the detection's trigger, such as the policy name, and applicable MITRE ATT&CK indicators and tags
• key information, such as the filename and process binary associated with an unauthorized USB file transfer attempt which triggered a policy
• origin-based tracking information, such as the website or SaaS app a file was downloaded from and the corresponding login user account name that was used
• associated actions and content, such as captured screenshots and message user feedback
• core metadata, which is the primary event information relating to the detection (also shown as "key information").

For example, core metadata for an email policy detection would include the Inspection pattern field that reports the matched content inspection pattern name(s), such as US Social Security Numbers (SSN).

• extended metadata, which is additional contextual information provided for policy detections for advanced analysis and response.

Extended metadata for the Unauthorized email sent or received template would include the mail_ci_matches field that reports the matched content inspection rule (specifying the data identifiers that have been found and the match frequency) and the email section(s) that were inspected.

For more on extended metadata, refer to the FortiDLP Policies Extended Metadata Reference Guide.

Actions that require a file upload, including take screenshot and make shadow copy, take longer to complete than other actions. If an action is viewed from an associated Detection details panel before it completes, it will display as "Not found" until it succeeds or fails.

The Detection details panel also allows you to quickly add the detection to a case and execute searches, filtering by associated properties.

Detection details panel

For details about the information reported for detections, see the detection properties listed in Investigate search properties.