Incidents – HTML5 version
Incident tab allows users to view and manage incidents.
Incident Attributes
This topic describes all the columns that can be used to create views in the Incident Dashboard. You can add or remove columns from the dashboard by clicking the Columns icon.
| Column Name | Description |
| Severity | The severity of the incident, High, Medium, or Low |
| Last Occurred | The last time that the incident was triggered |
| First Occurred | The first time that the incident was triggered |
| Incident | The name of the rule that triggered the incident |
| Incident ID | The unique ID assigned to the incident |
| Source | The source IP or host name that triggered the incident |
| Target | The IP or host name where the incident occurred |
| Detail | Event attributes that triggered the incident |
| Status | The status of the incident, Active, Cleared, Cleared Manually, System Cleared |
| Cleared Reason | For manually cleared incidents, this displays the reason the incident was cleared |
| Cleared Time | The time an incident was cleared |
| Cleared User | The person who cleared the incident |
| Comments | Any comments that users have entered for the incident |
| Ticket Status | Status of any tickets associated with the incident |
| Ticket ID | The ID number of any tickets generated by the incident |
| Ticket User | The person assigned to any tickets generated by the event |
| External User | If the ticket was cleared in an external ticket-handling system, this lists the name of the person the ticket was assigned to |
| External Cleared Time | If the ticket was cleared in an external ticket-handling system, this lists the time it was cleared |
| External Resolved Time | If the ticket was resolved in an external ticket-handling system, this lists the time it was resolved |
| External Ticket ID | The ID of the incident in an external ticket-handling system |
| External Ticket State | The state of the incident ticket in an external ticket-handling system |
| External Ticket Type | The type assigned to the incident ticket in an external ticket-handling system |
| Organization | The organization reporting the event |
| Impacts | Organizations impacted by the event |
| Business Service | Business services impacted by the incident |
| Incident Notification
Status |
Status of any notifications that were sent because of the incident |
| Notification Recipients | Who received notification of the incident |
| Incident Count | How many times the incident has occurred during the selected time interval |
Viewing Incidents
Device Risk View of all incidents
List view of all incidents
Viewing incident details
Grouped View of all incidents
Device Risk View of all incidents
This is the default view when user clicks the Incident tab. It shows a list of devices that triggered incidents. Devices are ranked by a risk score that is computed by combining asset criticality, triggered incidents and found security vulnerabilities (details – here).
To see the incidents for a device, click that device. The incidents show up in a time line view.
List view of all incidents
This view provides a list of all incidents over a time period. By default:
Active Incidents over the last 2 hours are displayed
The following incident attributes are shown
Severity – High, Medium, Low – shown by colored icons
Last Occurred – the last time the Incident happened
Reporting Device Name – names of devices that reported the events that led to the incident Incident – rule name
Source – incident source
Target – incident target
Detail – incident parameters other than source and target
Count – number of times the same incident has triggered
To show incidents over a different time interval
Click Time Range Button
A search window appears
To choose a relative time window
Choose Time Range Operator as LAST.
Specify the number of Minutes/Hours/Days/Weeks.
Click Check button.
The Incident page will automatically refresh to show all the incidents over the time window.
To choose an absolute time window
Choose Time Range Operator as FROM.
Specify the starting and end times.
Click Check button.
The Incident page will automatically refresh to show all the incidents over the time window
An incident can be in any of the following states
Active
Cleared
Cleared Manually
System Cleared
By default only Active Incidents are shown. To show Incidents in other states
Click Incident Status Button A search window appears
To add a new value, click on the white space next to the selected value. A menu appears. Select the needed values one by one.
Click Check button
The Incident page will automatically refresh to show all the incidents in selected state(s)
To select a different set of Incident attributes
Click Choose columns icon
In the popup, select the columns you want to display by moving them to the right. You can re-order the position of the columns. ClickOK.To force a refresh of the incident view, click the Refresh icon
Incidents may be displayed over multiple pages. To see incidents on a different page,
Select the Page Selector icon
Either enter the page number or click on the Next or Previous icon to go to the right page
To view incidents for a different organization (Service Provider version),
Click the User icon on top right
Choose the right organization
Click Change View
Viewing incident details
In the default view, an incident is shown in a single line. To see the details of the incident,
Click anywhere on the incident line
Basic incident attributes are shown immediately below the incident More advanced incident attributes are shown in a bottom pane
To revert to the single line incident view, click anywhere on the incident line. Detailed views will disappear.
To view the rule that triggered the incident,
Click anywhere on the incident line in the single line incident view In the bottom pane, Click Rule tab. Rule details are displayed.
To view the events that triggered the incident
Click anywhere on the incident line in the single line incident view
In the bottom pane, Click Events tab. Basic Event attributes are displayed in a single line. To see the raw events, click on the Basic Event line. Raw events are displayed.
Grouped View of all incidents
Sometimes user may need a grouped view of incidents to get an overview of what incidents have triggered and involves which devices. The following grouped views are provided
Severity – Ranks Incident Severities By Count
Name – Ranks the Incidents By Count
Name, Target – Ranks Incident Name and Incident Target By Count
Name, Source – Ranks Incident Name and Incident Source By Count
Name, Source, Target – Ranks Incident Name, Incident Source and Incident Target By Count
Name, Source, Target, Business Service – Ranks Incident Name, Incident Source, Incident Target and Business Services By Count Name, Source, Target, Business Service, Organizations – Ranks Incident Name, Incident Source, Incident Target, Business Services and Organizations By Count
Searching Incidents
Searchable Incident Attributes
Constructing Search Condition
Searchable Incident Attributes
| Incident Attribute | Description |
| Time Range | In |
| ID | Incident ID |
| IP | Incident Source IP or Incident Target IP |
| Host | Host name associated with Incident Source IP or Incident Target IP |
| User | User field specified in Incident Target or Incident Details |
| Severity | Incident Severity category – High, Medium or Low |
| Function | Security, Availability, Performance or Change. This is a property of an Incident. |
| Incident Status | Possible values are Active, Cleared, Cleared Manually, System Cleared |
| Ticket Status | Possible values are New, Open, Closed, External, reopened, None. External means opened in an external system. |
| Incident | Rule name |
| Biz Service | Business Service name |
| Organization | Organization name |
Constructing Search Condition
To construct a Search condition from a displayed Incident,
Mouse over the cell containing the specific Incident attribute
Right click and choose Add to filter
The condition will be added to existing search string
Matching incidents will be displayed
To construct a Search condition from scratch
Click on the Add filter edit area. Three fields are displayed
Incident Attribute
Operator
Value
Select one of the Incident Attributes from the drop down
Select an Operator from =, != IN, NOT IN, CONTAINS, NOT CONTAINS Select one or more Values from the displayed choices Click the Check button.
Matching incidents will be displayed
Managing Incidents
Adding Comments
Clearing Incidents
Exporting Incidents to a PDF document
Adding Comments
Click on an Incident in the un-grouped view From Actions drop down, select Add Comments Write the comment and click OK.
Clearing Incidents
Click on an Incident in the un-grouped view
If you have more incidents to clear, then press Shift and click on the second incident. This will will select all incidents between the first one and this one. To get this approach to work effectively,
Create a filter to get all the incidents to be cleared in view
Select the first incident
Press Shift and click on the last incident – all incidents are now selected From Actions drop down, select Clear Click OK
Exporting Incidents to a PDF document
Click on an Incident in the un-grouped view
If you have more incidents to export, then press Shift and click on the second incident. This will will select all incidents between the first one and this one. To get this approach to work effectively,
Create a filter to get all the incidents to be exported in view
Select the first incident
Press Shift and click on the last incident – all incidents are now selected From Actions drop down, select Export Click OK