The Alert Details page provides detailed information about a security alert, including its detection rule, severity, associated endpoint, event timeline, and available remediation actions. Security analysts can review the alert, investigate the associated file or activity, assign the alert for investigation, and perform supported remediation actions.
The page consists of the following sections:
- Alert Details
- Event Timeline
- File Details
- Remediation
Alert Details
This section displays the alert summary and associated endpoint information.
| Field | Description |
|---|---|
| Alert ID | Displays the unique identifier of the alert. Use the Copy icon to copy the alert ID. |
| Rule Name | Displays the name of the detection rule that triggered the alert. |
| Description | Provides a brief description of the event or condition that triggered the alert. |
| Incident Name | Displays the incident associated with the alert. If the alert is not associated with an incident, Unassociated is displayed. |
| Created On | Displays the date and time when the alert was created. |
| Source | Indicates the source of the alert, such as EDR. |
| Severity | Indicates the severity assigned to the alert, such as Low, Medium, High, or Critical, depending on the alert. |
| Assigned To | Displays the analyst or user assigned to investigate the alert. If no user is assigned, Unassigned is displayed. |
| MITRE TTP | Displays the MITRE ATT&CK tactics, techniques, and procedures associated with the alert, where applicable. |
| Host Name | Displays the name of the endpoint on which the event occurred. |
| Users | Displays the user associated with the event. |
Managing Alert Details
- Incident Name: Review the incident association to understand whether the alert is linked to an existing incident.
- Assigned To: Use the Edit icon to assign the alert to an appropriate analyst or update the assignment.
- Severity: Use the Edit icon to update the alert severity, if required.
Event Timeline
The Event Timeline provides a chronological representation of the events associated with the alert. Each event is represented by a timeline entry that displays the associated activity and its timestamp.
Use the timeline to review the sequence of events and identify activities that may require further investigation.
File Details
The File Details panel displays information about the file associated with the selected alert.
The panel includes the following fields:
| Field | Description |
|---|---|
| File Name | Displays the name of the file associated with the alert. |
| Timestamp | Displays the date and time associated with the file event. |
| File Path | Displays the location of the file on the endpoint. |
| Host Name | Displays the name of the endpoint on which the file was detected. |
| OS Name | Displays the operating system identified for the endpoint. |
Use the Copy icon next to the applicable field to copy its value, where available.
Remediation
The Remediation section provides actions that analysts can perform on the file associated with the alert. The available actions include Quarantine, Send to SMAP, and Add to Whitelist.
Quarantine
Use this action to quarantine the associated file to prevent it from being accessed or executed normally on the endpoint, subject to the supported remediation workflow.
Send to SMAP
The Send to SMAP action allows analysts to manually submit a suspected file to the Seqrite Malware Analysis Platform (SMAP) for analysis directly from the XDR console.
Use this action when additional analysis is required to determine whether a file is clean or malicious.
Prerequisites
- The SMAP connector must be configured in XDR with the SMAP URL and API key.
- The endpoint sensor must be version 3.4 or later.
- The file must be within the supported size limit of 128 MB.
- Binary-signed processes cannot be submitted to SMAP.
To submit a file to SMAP:
- Navigate to Alerts and open the required alert.
- Review the alert details and identify the file to be analyzed.
- In the Remediation section, click Send to SMAP.
- Initiate the submission for the required file path, as prompted by the interface.
- XDR sends a remediation action to the endpoint agent to retrieve the specified file and upload it directly to SMAP for analysis.
- After the analysis is complete, XDR retrieves and displays the final verdict for the submitted file.
Understanding SMAP Verdicts
The SMAP Verdict column displays the result of the file analysis. The available verdicts are:
- Ransomware: The file has been identified as ransomware.
- Malware: The file has been identified as malicious.
- Suspicious: The file exhibits suspicious characteristics and may require further investigation.
- Unknown: SMAP could not determine a definitive verdict for the file.
- Clean Files: The file has been identified as clean.
Review the verdict along with the file hash, original file path, endpoint, and associated alert information when investigating a file.
For detailed malware analysis information, refer to the corresponding analysis report in SMAP, where available.
Important considerations
- A file that has already been quarantined may affect the submission workflow. The ability to retrieve and submit the file depends on its availability to the endpoint agent.
- Only the final verdict is displayed in XDR in this phase. Detailed analysis reports remain available in SMAP.
- Ensure that the SMAP connector configuration and endpoint sensor prerequisites are satisfied before initiating a submission.
Add to Whitelist
Use this action to add the associated file or applicable detection to the whitelist, subject to the supported whitelisting workflow. Review the file and its associated activity carefully before whitelisting it to avoid allowing potentially malicious activity.