Kaspersky Next XDR Expert

Viewing the incident table

The incident table provides an overview of all created incidents.

To view the incident table:

1. In the main menu, go to Monitoring & reporting → Incidents.
2. If necessary, apply the tenant filter. By default, the tenant filter is disabled and the incident table displays the incidents related to all of the tenants to which you have access rights. To apply the tenant filter:
   1. Click the link next to the Tenant filter setting.

      The tenant filter opens.

   2. Select the check boxes next to the required tenants.

      The incident table displays only the incidents that were detected on the assets that belong to the selected tenants.

The incident table is displayed.

The incident table has the following columns:

• Created. Date and time when the incident was created.
• Threat duration. Time between the earliest and the most recent events among all of the alerts linked to the incident. By default, this column is hidden.
• Updated. Date and time of the last change, from the incident history. By default, this column is hidden.
• Incident ID. A unique identifier of an incident.
• Status. Current status of the incident.
• Status changed. The date and time when the incident status has been changed.
• Severity. Severity of the incident.
• Priority. Priority of the incident.
• Number of linked alerts. How many alerts are included in the incident. By default, this column is hidden.
• Name. A name of an incident.
• Rules. The rules that were triggered to create the incident.
• Affected assets. Devices and users that were affected by the incident. If the number of assets affected by or involved in the incident is greater than or equal to three, the number of affected devices is displayed. By default, this column is hidden.
• Tenant. The name of the tenant in which the incident was detected.
• Analyst. Current assignee of the incident.
• Last action. The name of the playbook or response action launched for the incident.
• Result. The result of the playbook launch.
• Action time. The date and time when the playbook or response action was launched. By default, this column is hidden.
• Source. The application that detected the incident. By default, this column is hidden.
• Technology. The technology that detected the incident. By default, this column is hidden.
• SID. Security identifier of the incident. If the number of identifiers is greater than or equal to three, the number of identifiers is displayed. By default, this column is hidden.
• Creation method. How the incident was created—manually or automatically. By default, this column is hidden.
• Observables. Number of the detection artifacts, for example, IP addresses or MD5 hashes of files. If the number of observables is greater than or equal to three, the number of observables is displayed. By default, this column is hidden.
• CII object. Information about whether an asset is a critical information infrastructure (CII) object.