Incident Timeline

The Incident Timeline shows the timeline of all the events of an incident, starting from the time the incident was created.

To view the Incident Timeline page:

  1. Access XDRClosed Extended Detection & Response and click Incidents > Incidents.

  2. Click the incident title or hover over the incident and click >.

  3. Click Incident Timeline.

Legend

Item

Description

1

Date

Date of event.

2

Time

Time of event.

3

Event type
Icon Description

Action generated from an InsightClosed An aggregation of one or more logs into valuable observations indicating the nature of the activity. by XDR.

To view the Insight details, hover over the action and click >. The Insights & Forensics page appears.

Automatic prevention action by XDR.

To view the Incident Overview page, hover over the action and click >.

Manual prevention action by the user or administrator. For example, adding an indicator to the IoC Management.

To view the Incident Overview page, hover over the action and click >.

User action. For example, user updated the incident status.

4

Severity

Severity of the event. An event is color-coded based on its severity.

5

Assets

(Applies to Insight type only)

Number of assets involved in the incident.

To view the asset details, click the Assets link. The Affected assets page appears.

6

Indicators

Number of indicators created for the incident.

To view the indicator details, click the Indicators link. The Indicators & Artifacts page appears.

7

Source of the incident (Applies to Insight type only)

N/A

8

Sort by time

Sort events in the chronological or reverse-chronological order.

9

Filter the timeline by:

  • Type

  • Severity

  • Data Sources

10

Create an exclusion for the incident. See Exclusions.

11

Add a comment on the incident.

12

Status

Status of the incident.

  • New

  • In Progress

  • Close - Handled

  • Close - False Positive

  • Close - Known Activity

13

Assignee name

Security expert to whom the incident is assigned.

14

Search

Enter free text to search in the timeline.