Incidents

Incidents cut triage and investigation time by grouping together policy detections that have the same root cause. With this automated, condensed view of related detections, you get the context you need to assess and respond to threats without the hassle.

The Incidents module supports two incident types:

• A clustered incident is formed by a clustering rule, which are detailed in the FortiDLP Policies Reference Guide. It groups together detections by a common property (such as a domain name, filename, and so on) or a common policy. A clustered incident can encompass detections for one or multiple entities. Once a clustered incident is raised, subsequent related detections are added to it until it is resolved by an operator. After an incident is resolved, a subsequent detection that is clustered in the same manner would raise a new incident.
  

Let's say the Sensitive file uploaded to personal file share website policy has been configured to raise incidents that group detections by a common, unauthorized domain name—for example, drive.google.com. If 200 users across multiple departments attempt to upload sensitive files to Google Drive, this would result in a single incident comprised of 200 detections.

• A sequenced incident is formed by a sequence rule that leverages the MITRE ATT&CK security framework. It groups together detections for a chain of threat activities that have occurred during a given time window. A sequenced incident encompasses detections for one entity (user/node) only. Once a sequenced incident is raised, subsequent related detections are added to it until the associated sequence rule's time window has elapsed, an operator updates and publishes a new sequence rule definition, or an operator resolves the incident. After one of these conditions occur, a subsequent detection triggered by the sequence rule would raise a new incident.
  

Let's say a sequence rule is made up of three stages (for example, Defense evasion, Collection, and Exfiltration). Each stage has corresponding policies, and if a user violates at least one policy in a stage, that stage is met. If the same user violates at least one policy in each required stage during the defined time window, an incident will be created that encapsulates all associated detections.

The Incidents module lets you manage incidents individually or in bulk.

To learn more, see:

• Viewing incidents
• Reviewing incidents
• Exporting incidents
• Resolving incidents.