Incident Details

The Incident Details window displays the information about the following:

Summary

The Summary section in the Incident Details provides the overall overview of the the Asset Details, Threat Actors and Malware Summary. 

• Threat Actors: As the name suggests Threat Actor(s) can be an individual or a group of attackers trying to infect your network. If such actor(s) has tried to perform a malicious activity in the network, you can get the list of these actor(s) in the Threat Actor(s) section of the Summary page. If Threat Actor(s) does not exist for the event severity score displayed in the Summary, the Threat Actor(s) is not listed. 

  Lists of all the Threat Actor(s) is listed in the Event Details of the Timeline section, irrespective of the event severity score.

• Malware Summary: For the malicious events that occurred, the Malware Summary lists the malware name and its description. 

  The following screenshot is an example that lists the Threat Actor(s) and Malware Summary of an event:

  

Actions

You can Change Status, Assign Incident, or Add Comment from the Actions menu. Using the Add Comment option, you can provide comments about the incident. Only the writer of the comment can edit or delete their comment. 

The following screenshot is an example of the Incident Summary and Actions:

Timeline

The Timeline section provides the list of the detected events. Alternatively, you can search for the detected events from the Search for events search bar using the Events Search Token and choose a remediation action if applicable. You can enhance the search results by selecting the timeframe from Last 2 year to Today. Select the drop-down Last 30 days to view the list of timeframe options. 

Assessment and Detection Source filters in the Timeline section displays the list of event based on the selected options. 

• Assessment: The Scored and Not Scored fields in the Assessment filter lists the events based on the severity score.
  • Scored: Scored lists the events with the Severity Score from 1 to 10.
  • Not Scored: Not Scored lists the events with the Severity Score 0.
• Detection Source: From the Detection Source filter you can select the threat source as, Anti-malware, Behavioral Detection, and Threat Intel. 

You can select multiple threat source while using the Detection Source filter. 

Process Tree

You can perform the remediate action from the Process Tree section. The process tree displays all the related events of the selected incident. An event of the “Process” type will show its parent and child processes. 

In the process tree view, you can traverse between the nodes by clicking a node in the hierarchy. You can click the (+) and (-) to expand and collapse the tree nodes and display the related events.

In the Threat details section, you can view the detection engine (Malware Detection, Yara rules, Behavioral Analysis, Threat Intelligence, etc.) for the event and the event risk score. The Process Tree view displays a zoom bar and reset option. The filter can view a specific event type in the process tree. The Process event will always be visible.

Comments

The comments you add using the Actions menu are listed in the Comments section. For Antimalware Assignee, with the closed Status, by default, the comment displayed is based on the action performed. 

For example, in the following screenshot, the network has been closed. Hence, the comment displayed is Network Closed.

Activity Log

The Activity Log logs all the actions you perform on the Incident page. The following screenshot is an example of the Activity Log:

Risks and Exploits

The Risks and Exploits section focuses on the data generated via the integration with Qualys Vulnerability Management Detection and Response (VMDR) and Qualys Policy Compliance (PC) applications. The Patch Management (PM) integration helps you to patch vulnerabilities. 

Prerequisites

• VMDR subscription for Threat Risk & Exposure
• PM subscription to patch vulnerabilities
• PC subscription for System Misconfiguration

Threat Risk & Exposure - Integration with Qualys VMDR

The Threat Risk & Exposure section lists the vulnerabilities linked to an incident alongwith the option to patch those vulnerabilities. The integration with VMDR helps you to remediate endpoints basis the QID, Title, CVE, Malware, and QDS. When a Patch is available for a vulnerability, the Patch Now option is enabled. You can view the Vulnerabilities by selecting the Malware from the Filters drop-down, or by selecting the type of Host- All Hosts and Current Host.

• All Hosts- Select this option to get the list of vulnerabilities that have impacted all the hosts. The Total Hosts column lists the hosts impacted by the vulnerability. The following screenshot is an example of the All Hosts selection:

  

• Current Host- Select this option to get the list of vulnerabilities that have impacted the host for which you are viewing its Incident Details. 

  In the following screenshot, the vulnerabilities listed are for the Current Host, in this case- Desktop-v3RH712:

  

How do I get more insights about Risks and Exploits using VMDR?

1. Click View Details in VMDR. You will be redirected to the Vulnerabilities tab of the VMDR application. 
2. In the Vulnerabilities tab, the vulnerabilities are listed based on the CVE IDs. The Vulnerability token enlisted is `vulnerabilities.vulnerability.cveIDs:[CVE ID number]`. Click on any of the QID to get insights of the Vulnerability. 

How can I patch the vulnerability detected in EDR using the Patch Now option?

If you have Patch Management subscription, the Patch Now option will be enabled for you. 

1. Click Patch Now. You are redirected to the Jobs tab of the Patch Management application. 
2. In the Basic Information section, the Job title is pre-populated. 
3. In the Select Assets section, the assets are populated based on the asset tags selected. You can add or exclude asset tags for the job.
4. In the Select Patches page, select the type of patch you want to install. The patches are pre-populated; if required, you can select more patches. 
5. Provide information for the remaining fields and click Save and Enable. 
   For more information, see Creating Patch Job for Windows Assets

System Misconfiguration - Integration with Qualys Policy Compliance

The System Misconfiguration section lists the CIDs, Control Statement, Technology/Instance, MITRE Technique ID and Policy that failed the Qualys Policy Compliance assessment due to endpoint misconfiguration. To get complete summary of a CID, click any of the CID and you are redirected to the Posture Details page of PC application. Using the Remediate now option you can remediate a Control Statement. 

The following screenshot is an example of the System Misconfiguration page:

How can I use the Remediate now option?

1. From the System Misconfiguration section, select the CID you want to Remediate. The  icon represents the CID is remediable. 

   You can select bulk CIDs for remediation.

2. From the Actions drop-down, select Remediate now. 

   The following screenshot is an example of the Remediate now option in the System Misconfiguration section of EDR application:

   

3. You are redirected to the Posture tab of the PC application. Click Remediate Now from the PC application or you can perform other actions from its Quick Actions menu. 

   For more information about the Posture in PC application, refer Know Your Compliance Posture. The following screenshot is an example of the Posture tab in the PC application:

   

Additional Resource

• MITRE ATT&CK webpage