Get an overview of the detected network events associated with the target node and associated objects.
The Summary displays the severity, number of detected internal hosts, number of indicators of
compromise (IOCs), and attack patterns, as well as provides a high-level overview
of the malicious activity of the correlated event.
You can export the summary data as a CSV file or in a printer-friendly format. Click
Export and choose the format you want to use.
 |
NoteIf you applied an advanced filter in the Correlation Graph, the exported report only
contains the filtered information.
|
The summary includes various details about the network activity and provides actions
you can take to investigate the event.
|
Detail
|
Description
|
Available actions
|
||
|
Severity
|
The severity assigned by Network Analytics to the event and related correlations.
Network Analytics uses a number of factors to assign severity, including proprietary
analysis.
|
-
|
||
|
Internal Hosts and Indicators of Compromise detection count
|
The number of hosts within your network involved in the event and the number of indicators
of compromise (IoCs) detected
|
Click the detection number and then click Copy to clipboard (
 ) to copy the list to your clipboard. |
||
|
Attack patterns
|
The detected attack patterns for the suspicious object selected in Workbench.
|
Hover over an attack pattern to highlight only activities related to that attack pattern
in the summary.
|
||
|
Activity summary
|
The activity summary is organized by attack pattern and provides the following information:
|
Hover over the details icon (
 ) for an IP address or domain and select one of the following actions:
|