Manage Related Incidents

Go to the incident that you are investigating and click

Related Incidents

.

The incident you are currently investigating is at the center of the Related Incidents map, surrounded by the related incidents. The more similar a related incident, the closer it is to the center.
The incidents are categorized according to incident status (pending, active, and closed) and type (such as malware, phishing, and so on). In this example, phishing is categorized:
Shape	Status
	Pending status
	Active status
	Closed status
The map has a time spectrum. Incidents on the right side of the map are newer than the current incident, and the incidents on the left are older. Related incidents are spread across the spectrum according to the time the incident was created. The time scope is 30 days before and 30 days after the currently investigated incident. You can modify the range by using the
Date Range
.
Use the
Similarity Scale
to display related incidents that are more similar or less similar to the current incident.
Hover over a related incident to view detailed information.
Click an incident to view a comparison of the two incidents, which shows instances of similar indicators between the incidents. You can click multiple incidents by using
ctrl + click
or
command + click
. In the
Similarities
window, you can pair as
Linked
or as
Duplicate
. The incident appears as linked in the
Linked Incidents
table in the
Case info
tab.