Alert details | Trend Micro Service Central

Views:

Workbench provides detailed alert information for more effective investigations.

The following table describes the basic information Workbench provides about alerts.

Element

Description

Status

Status: The current status of the alert or investigation triggered in Workbench

Open: The alert is new and not currently under investigation
In progress: The alert is under investigation.
Closed: The alert investigation is complete.

Score

The overall severity assigned to the alert

Trend Vision One calculates the score based on the severity of the matched detection model and the impact scope of the alert.

Note

Starting on January 18, 2021, Trend Vision One adjusted the scoring model and redefined the maximum alert score as 99. The new scoring model only affects new alerts.

The new scoring model takes the severity of the matched model as the dominant factor in calculation and defines a certain threshold for the impact scope value.

Workbench ID

The unique identifier for the alert

Model name

The detection model that triggered the alert

Model severity

The severity assigned to a model that triggered the alert

Impact scope

The number of entities that the alert affects within the company network

Data source / processor

The product that is providing the data to the Workbench app

Created

The date and time Trend Vision One generated the alert

Findings

Findings: The findings of the alert investigation.

Available values:

Confirmed incident: The investigation confirmed the occurrence of threats or malicious activities.
False positive: No malicious activity found.
Benign true positive: The investigation has confirmed the presence of a genuine threat that poses no risk to the organization.

Benign true positives are the result of penetration test or other legitimate activities in your environment.
Noteworthy: Observations have identified suspicious activity that requires more investigation.
-: The investigation has no findings.

Case

The ID of the case assigned to the alert.

Owner

The user assigned to the alert.

Associated insight

The Workbench insight associated with the alert

Automated response

The status of the automated response tasks associated with the alert

The following table describes the alert information displayed on the alert details screen.

Element

Description

Summary

Basic information of the alert you investigate

If the alert is triggered by the Threat Intelligence Sweeping model, the following information displays:

Campaign: The associated threat campaign
Industry: The industry that the threat campaign belongs to
Intelligence source: The data source that provides the matched intelligence report
First seen: The date and time indicators of compromise were first identified in the environment
Last seen: The date and time indicators of compromise were last identified in the environment

Highlights

The list of the event objects that triggered the alert with contextually enriched information.

Events consist of the following information:

The filter that detected suspicious behavior
Technique: The detected MITRE technique
Detection: The detected malware
Data source / processor: The product that sent the alert data to Workbench
Emerging threats: The emerging threats associated with the detection
Threat actors: The threat actors associated with the detection
Exploited CVE: The detected CVE and additional information about the campaigns actively exploiting the vulnerability
Malware/Tool: The tools or malware detected in the alert
The date and time the detection occurred

The objects involved in the event, such as endpoints, commands, email messages, and registry values

Note

There are two types of objects involved in an event:
- Highlighted objects that triggered the current filter
- Entities included in the impact scope
If the alert is triggered by the Threat Intelligence Sweeping model, the Highlights section shows the identified IoCs, data source/processor, and the related objects instead.

Timeline

Displays the date and time the detection occurred

Observable Graph

Provides more detailed context for the alert in a visualized form

Click any of the events in the Highlights section to highlight the specific objects in the Observable Graph.

Each node in the graph refers to an object, and each link reflects the relationship between one node and the adjacent node.

Each line () represents the association between the two objects, for example, a user account associated with an endpoint.
Each arrow () indicates the direction of the transaction between the two objects, for example, the direction from the email sender to the recipient.
The Connection Details icon () indicates the connection between the two objects, for example, the connection between an endpoint and a website.

Note

Click the Connection Details icon () to view more information.

Related assets

Displays the most recent endpoints and users that communicated with the assets involved in the event