NOTE: To perform this function you must have user permission to create Incidents.
This is useful in grouping a set of events together as a whole representing something of interest (group of similar events or set of different events that indicate a pattern of interest such as an attack).
NOTE: If events are not initially displayed in a newly created Incident, it is most likely because of a lag in the time between display in the Real Time Events window and insertion into the database. If this occurs, it may take a few minutes for the original events to finally be inserted into the database and display in the incident.
To create an Incident:
NOTE: It is possible to create an incident that does not contain any events. Events can always be added to Incidents.
In a Real Time Event Table of the Visual Navigator or a Snapshot Real Time Event Table, select an event or a group of events and right-click and select Create Incident.
In the Incident Window are the following tabs:
Events: Shows which events make up the incident
Assets: Show affected assets
Vulnerability: Show related asset vulnerabilities
Advisor: Asset attack and alert information
iTRAC: Under this tab, you may assign an iTRAC Process
History: Incident history
Attachments: You may attach any document or text file with pertinent information to this incident
Notes: You may enter any general notes you want to refer regarding this incident.
In the Create Incident dialog box, enter:
|
|
Click Create. The incident is added under the Incidents tab of the Sentinel Control Center.