So now that the 40 Analyzer has incidents that were either created or raised
from existing events
or manually created by an administrator or were automatically created as a
result of an event
handler, how do we now work with and manage those incidents? And that's the
topic of this video.
So let's head over to the 40 Analyzer and let's begin. So here we are at the 40
Analyzer to get
to our instance. We'll go to instance and events on this version of the 40
Analyzer, which is version
7.63 and under instance and events, we'll go to incidents. So at the top, we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
7.63 and under instance and events, we'll go to incidents. So at the top, we
have three tabs,
we have incidents, then there's the MITRE attack option and then we have the
MITRE attack ICS.
ICS stands for industrial control systems like SCADA systems and so forth. So
starting in the
far left tab right here of instance, we have our charts, we can go ahead and
not show those charts
if you don't want to see them or we can show those charts or we can control
which charts are shown.
So currently we have two of the severe one that's medium and none of the low
and that severity
column is shown right here. Also, when new incidents show up, if it's
associated with their WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
associated with their
credit automatically, we probably want to alert somebody. So in addition, there
's an option here
regarding incidents. If we click on more and go to settings, we can also
specify to send notifications.
So to do this, we'd have to set up actual destinations like syslog servers or
SNMP and email and so
forth. And then when they are, we can select that destination, for example,
email or some other
destination and then specify that notification should be sent when an incident
is created or
incident is updated or an incident is deleted. And that way, you can make sure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
incident is updated or an incident is deleted. And that way, you can make sure
the right people know
about the incidents that are happening. So we'll click on cancel there. So if
we need to modify or
edit an incident, we can, for example, if we click here and just right click
and you can click on
edit, there's also an edit button right there that allows you to edit it, which
we could use to go
ahead and modify some of the details, including the name or the category or the
MITRE Tech ID or
severity and comments and so forth. So we'll make no changes for the moment. We
'll click on cancel.
There's an option for analysis, which is also available by right clicking and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There's an option for analysis, which is also available by right clicking and
then from the drop
down clicking on analysis or clicking on it here. So let's go ahead and do that
. Another way of
getting into the analysis for an incident is simply to double click and that
also takes you to the
incident analysis. Now there's also options for enrich and block. Now if you
have set up, for example,
the 40 analyzer to interact and work with virus total, the enrich option will
reach out and get
that additional information. For example, especially if it's virus related to
give you more information
or if we have for the manager set up and we're using for the manager to manage WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or if we have for the manager set up and we're using for the manager to manage
all of our devices,
we can also implement a block which leverages for the manager to put a block.
So here in the
incident analysis, there's multiple widgets and you can also control how it
looks. So if we click
right here and edit layout, for example, if you want to go ahead and you just
have one column
and then scroll all the way down here on the far right, see all the various
widgets we can,
or if you want to have two columns or three columns and so forth, just control
it right there and
then click on save. If you want to export the incident, there's great options
for that as well.
Just click on export and then you can export it as an HTML or a PDF document WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Just click on export and then you can export it as an HTML or a PDF document
that's basically the same
information that's being shown right here. There's also an option here to
execute playbook. We'll
have a separate set of videos regarding playbooks and automation and that can
also be helpful in
getting more information regarding this incident and based on the type of
incident, there's also
option here to run a report. There's also a quarantine option for assuming you
have the right
connectors in place and the right software running at those endpoints to make
that happen. Also,
if other admins are working on this or updating it, you can click on refresh to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if other admins are working on this or updating it, you can click on refresh to
make sure we're
looking at the latest and greatest information. So I'm going to go ahead and
edit the layout and
put this in single columns. We have one widget at a time. I'll go ahead and
save that. So our
first widget here is the incident summary, which has the basic information
regarding the incident.
And so if we scroll down here, we can see all that detail. And then if we on
the far right scroll
down, we're then going down to the next widget. So here's the affected endpoint
slash user,
which is ad user to which is another great reason to do user authentication. So
we can associate
not just an IP address with the problem or the event, but also associate the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
not just an IP address with the problem or the event, but also associate the
user. So this user,
which is at the address of 10, 20, 0, 1, 0, 2, or at least was at this point in
time, it's a Linux
client. And if we scroll down, we have the affected assets, which is this Linux
client at this IP
address with that Mac address. So here we can add comments. For example, we
discover something new
or run the middle of something we could add comments here that would become
part of this incident
as we scroll down. Here's the events widget, which is showing the actual events
that went into this
incident when we created it initially. Here's the instant timeline. So there's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
incident when we created it initially. Here's the instant timeline. So there's
the date range
and it happened back here. It also happened here. And if playbooks had been run
against this,
it would show it here in the executed playbooks widget. And if we scroll down,
we have an audit
history widget. So the events attached to the incident were by admin on this
date. And there's
the incident number. Here's a section for reports that have been added to this
incident. So at the
moment, we don't have any reports. But for example, if we went down to reports,
we said, you know what,
let's go ahead and let's go to report definitions. There's a whole bunch of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's go ahead and let's go to report definitions. There's a whole bunch of
defaults. Let's
imagine we wanted asset news reports. And let's go ahead and do an asset
identity report. Let's
right click on that. And we'll go ahead and run it. So that's running it. Then
we go to generated
reports and the report that we just ran should be here. It's just in a moment.
There it is. So it's
99% done. That's completely done. So we could then take that report, right
click on it and add that
to an existing incident. So click here on add to existing incident. And we want
to add to this one,
11, click on OK. Now that we've done that, let's go back to our incident and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
11, click on OK. Now that we've done that, let's go back to our incident and
events. Then there's
further widgets for indicators, software, processes, vulnerabilities. So back
at the incident, let's
go ahead and edit it. And it's no longer new. Let's go ahead and say that we're
in analysis mode
here where we're trying to find out what's going on. And it's currently
assigned to the admin. So
click on OK. So now that we have this incident that's created in the next video
, I'd like to walk
you through taking it through the next few steps to help really find out what's
going on. And
update this incident and we'll do that next video.