Kaspersky Endpoint Detection and Response Expert

Viewing incident details

Expand all | Collapse all

Incident details are a page in the interface that contains all of the information related to the incident, including the incident properties.

To view incident details:

1. In the main menu, go to MONITORING & REPORTING → Incidents.
2. In the incident table, click the ID of the required incident.

The window with incident details is displayed.

The toolbar in the upper part of the incident details allows you to perform the following actions:

• Assign the incident to an analyst
• Change the incident status
• Link alerts to the incident
• Merge the incident with other incidents

Incident details contain the following sections:

• The summary section contains the following incident properties:

  • Severity. Possible values: Low, Medium, or High. Incident severity shows the impact this incident may have on computer security or corporate LAN security based on Kaspersky experience.
  • Priority: Low, Medium, High, or Critical. Incident priority defines the order in which the incidents must be investigated. The incidents with the Critical priority are the most urgent ones and must be investigated in the first place. You can change the priority by clicking the current priority value.
  • Incident name. Name specified at the incident creation. You can change an incident name.
  • Creation method. How the incident was created—manually or automatically.
  • Rules. The IOC rules or IOA rules that triggered to detect the linked alerts.
  • Created. A date and time when the incident was created.
  • Updated. A date and time of the last change from the incident history.
  • First event. A date and time of the first event related to the incident. This is the earliest event in the Details section of the alert details among all of the alerts linked to the incident.
  • Last event. A date and time of the most recent event related to the incident. This is the most recent event in the Details section of the alert details among all of the alerts linked to the incident.
  • Technology. The list of technologies that detected the alerts linked to the incident.
  • Detection source. The application that obtained the telemetry data.
  • MITRE tactic. A tactic or several tactics detected in the alerts linked to the incident. The tactics are defined in the MITRE ATT&CK knowledge base.
  • MITRE technique. A technique or several techniques detected in the alerts linked to the incident. The techniques are defined in the MITRE ATT&CK knowledge base.
  • Device name, ID. The names and identifiers of the devices that were affected by the incident. By clicking the ellipsis icon next to the device name or device ID, you can open the shortcut menu related to the device name or device ID. Use this menu to learn more details about the device, for example, to view the device properties or search the device name or ID in Threat hunting.
  • User name, SID. The names and security identifiers of users whose devices or accounts were affected by the incident. By clicking the ellipsis icon next to the user name or user SID, you can open the shortcut menu related to the user name or user SID. Use this menu to learn more details about the user account, for example, to search the user name or SID in Threat hunting.
• Similar incidents

  In the Similar incidents section, you can view the list of incidents that have the same affected artifacts as the current incident. The affected artifacts include both observables and affected devices of the alerts linked to an incident. The list contains incidents in any status.

  By using the list, you can evaluate the degree of similarity of the current incident and other incidents. The similarity is calculated as follows:

  Similarity = M / T * 100

  Here, M is a number of artifacts that matched in the current and a similar incident, and T is total number of artifacts in the current incident.

  If the similarity is 100%, the current incident has nothing new in comparison with the similar incident. If the similarity is 0%, the current and the similar incident are completely different. Incidents that have similarity of 0% are not included in the list.

  The calculated value is rounded off to the nearest whole number. If similarity is equal to a value between 0% and 1%, the application does not round such value down to 0%. In this case, the value is displayed as less than 1%.

  Clicking an incident ID opens the incident details.

  Customizing the similar incidents list

  You can customize the table by using the following options:

  • Filter the incidents by selecting the term for which the incidents have been updated. By default, the list contains the incidents that have been updated for the last 30 days.
  • Click the Columns settings icon (), and then select which columns to display and in which order.
  • Click the Filter icon (), and then select and configure the filters that you want to apply. If you select several filters, they are applied simultaneously by logical AND operator.
  • Click a column header, and then select the sorting options. You can sort the incidents in ascending or descending order.
• Alerts

  In the Alerts section, you can view the list of the alerts linked to the current incident.

  By clicking an alert ID, you can open the alert details. You can also use the toolbar buttons to unlink alerts from the incident or assign the alerts to yourself.

• Assets

  In the Assets section, you can view the devices and users affected by or involved in the incident.

  By clicking a user name or a device name, you can:

  • Search the user name or the device ID in Threat hunting for the last 24 hours.
  • Search the user name or the device ID in other alerts.
  • Search the user name or the device ID in other incidents.
  • Copy the user name or the device name in the clipboard.

  You can also click a device name to open the device properties.

  By clicking a user SID or a device ID, you can:

  • Search the user SID or the device ID in Threat hunting for the last 24 hours.
  • Search the user SID or the device ID in other alerts.
  • Search the user SID or the device ID in other incidents.
  • Copy the user SID or the device ID in the clipboard.

  You can also click a device ID to open the device properties.

• Observables

  In the Observables section, you can view the observables that relate to the alerts linked to the current incident. The observables may include:

  • md5 hash
  • IP address
  • URL
  • Domain name

  By clicking a link in the Value or Data columns, you can:

  • Search the observable value or data in Threat hunting for the last 24 hours.
  • Search the observable in Kaspersky Threat Intelligence Portal (opens in a new browser tab).
  • Search the observable value or data in other alerts.
  • Search the observable value or data in other incidents.
  • Copy the observable value or data in the clipboard.
• History

  In the History section, you can track the changes that were made to the incident as a work item:

  • Changing incident status
  • Changing incident assignee
  • Linking an alert to the incident
  • Unlinking an alert from the incident
  • Merging the incident with other incidents