custom Describes how to investigate an incident in Cortex SOAR.
An incident investigation can be opened in the following ways:
- Automatically: If associated with a playbook, incidents open automatically for investigation and run the associated playbook.
- Manually: Open an incident manually by selecting the incident in the Incidents table.After an incident is created, it is assigned aPendingstatus in the incident table. When you start to investigate an incident the status changes automatically toActive, which starts the remediation process.
- CLI: If you want to open a incident in the CLI, type/investigate id=.<incidentID#>
When opening an incident, you see the following tabs, which assist you in the investigating the incident:
A summary of the incident, such as case details, work plan, evidence, and so on. Most of the fields are for information only, although you can add the following:
You can send a permalink to a specific Investigation Summary by copying its URL.
An overview of the information collected about the investigation, such as indicators, email information, URL screen shots and so on
A comprehensive collection of all investigation actions, artifacts, and collaboration. It is a chronological journal of the incident investigation. Each incident has a unique War Room.
A visual representation of the running playbook that is assigned to the incident.
View any entity which has been designated as evidence. The Evidence board stores key artifacts for current and future analysis. You can reconstruct attack chains and piece together key pieces of verification for root cause discovery.
A visual representation of incidents that share similar characteristics, such as malicious indicators, or part of a phishing campaign.
Visually maps an incident, its elements, correlated investigation entities, and the progression path of the incident, combining analyst intelligence with machine learning.
Related Incidentspage is orientated towards exploration and searching for similar data. The
Canvasmaps incidents and indicators by enabling you to decide what you want to include in a layout of your choice.
If you want to customize incident layouts, see Customize Incident View Layouts.
Recommended For You
Recommended videos not found.