Alert Inbox is home to all alerts generated by DefenseStorm GRID through triggers, PatternScout, or ThreatMatch. We provide different alert states to help organize and keep your inbox clean.
Once an alert is fired, it shows up as New in the Alert Inbox. During alert investigation, click the ✓ from the top of the Alert to send it to the Acknowledged folder. This signifies that the alert is no longer new, but has not been handled or completed. Once the investigation has completed, set the Alert to a Handled State:
- Escalated generates an incident ticket, which takes over as the final destination for that alert. (Even though it creates an incident, it can still be marked as False Positive if that is the end result.)
- False Positive means the trigger that generated the alert shouldn't have fired. Maybe the query needs to be tuned, or the thresholds, or maybe anomaly detection found a deviation that wasn't malicious. (Be careful marking an alert is a false positive because it affects future anomaly detection.)
- Dismissed is the middle ground, where it's not an incident, but also not a false positive.
Viewing Associated Events
Within the Alert, clicking the Alert name or Count number opens the Events page with all events linked to the alert. This shows you all log data for each individual event that contributed to the GRID firing the alert . You can also view a chart of the data to see the statistical graph form.