Detections table

The Detections Table is where you can view all detections. Whereas the Triage Detections and Detections Triage views show detections by detector or device, the Detections Table shows detections by detector and device over time. By default, the table displays detections for the last two weeks. A color-coded bar at the left side of the table indicates active and resolved detections. A green bar indicates an active detection. A red bar indicates a resolved detection.

To access the Detections Table:

• Go to Detections > Detections Table.

• On the Dashboard:

  • In the MITRE ATT&CK widget, click a bar in the chart.
  • In the Resolved Detections widget, click Total or click a data point in the chart.

Filtering events

By default, the Detections Table displays detections by all severities and detection statuses for the previous two weeks ending on the current date. You can use any column header to sort the detections. The Filters pane on left side of the page allows you to view detections for a specific IP, refine the list by Severity and Detection Status. You can also toggle between table and graph view.

Impacted Devices	Click the dropdown to view the list of impacted devices. Use the search field to enter an IP address to locate a specific device. You can also select one or more devices from the list to filter the view .
Time range	Click to open the date picker. Use the calender to set the start and end date or select an option from the Quick Ranges (Last Hour to Last 90 days). Click the Date Range Type dropdown to display detections by Active Date, Creation Date, and Resolution Date. The date displayed in the date picker will mirror the dates in the Entity Panel.
Severity	Select High (H), Medium (M), or Low (L).
Detection Status	All Detections that were active during time range and are still active or resolved now. For example, a detection that was active on May 5 and resolved on May 10 is counted as ALL. Active Detections that were active during time range and are still active. Resolved Detections that were active during time range and are resolved now.
Additional filters	Category Select a category from the list. See, Detections > Detector Categories. Created By Select and account that created the detector from the list. MITRE ATT&CK Select the detection by behavior from the list. See, MITRE ATT&CK. Assigned to Select a user assigned to a detection. Resolved by Select a user from the list. Resolution Select All, True Positive: Mitigated, True Positive: No Action, False Positive, or Unknown. Sensor Select one or more sensors from the list. Detection Name Select a parameter used for the detection from the list. Confidence Select All, High (H), Medium (M), or Low (L). Muted Select All, Unmuted or Muted. See, Muting . Disabled Select All, Enabled or Disabled. See, Disabling detectors. Assigned Select All, Assigned, or Unassigned.
Columns selectors	Individual Columns Select one of the following options: Show all columns Hide All Columns Reset to default Select columns to show or hide in the table. Column Profiles Select one of the following options: Click a profile in the list to view the layout. Save the profile Create a new profile. For more information, see Creating column profiles
CSV	Click to export the list as a CSV file.
Table View	Click for table view (default).
Graph View	Click to open the Visualizer.
Action	Select one of the following options: Create Detectors Manage Detectors Muted Devices Excluded devices Manage Subscriptions Click the Detections Context icon to view the detection in a timeline along with its behavioral observations. See Detections context.

Identified Assets

A crown icon appears only on assets annotated by FortiGuard ATR. It is color-coded to indicate severity levels:

• Red for high risk
• Orange for moderate risk
• Yellow for low risk