Network Detections - Detection Details - Detection Information

Views:

Information provided in the Detection Information section may include the following:

Activity detected
Attack phase
Correlation Rule ID (ICID)
Detection name
Detection rule ID
Detection severity
Detection type
Event class

MITRE ATT&CK™ Framework

Tactics
Techniques

Tip

Click the tactic or technique to view more details on the MITRE website.

Important

MITRE information displayed on Deep Discovery Director (Internal Network Analytics Version) is based on ATT&CK™ v6. The information may be different when displayed on products that use a different version of ATT&CK™.

Notable Object
Protocol
Reference
Targeted attack campaign
Targeted attack related
Threat
Threat description
Timestamp
URL category
Virtual Analyzer risk level

Note

Additional information may appear for specific correlated incidents.

Detection Types

Detection Types	Description
Correlated Incident	Events/detections that occur in a sequence or reach a threshold and define a pattern of activity
Disruptive Application	Any peer-to-peer, instant messaging, or streaming media applications considered to be disruptive because they may do the following: Affect network performance Create security risks Distract employees
Exploit	Network and file-based attempts to access information
Grayware	Adware/grayware detections of all types and confidence levels
Malicious Behavior	Behavior that definitely indicates compromise with no further correlation needed, including the following: Positively-identified malware communications Known malicious destination contacted Malicious behavioral patterns and strings
Malicious Content	File signature detections
Malicious URL	Websites that try to perform malicious activities
Suspicious Behavior	Behavior that could indicate compromise but requires further correlation to confirm, including the following: Anomalous behavior False or misleading data Suspicious and malicious behavioral patterns and strings