Alert View

The Alert View screen displays alerts triggered by detection models and allows you to further investigate each alert.

You can investigate alerts through an in-depth root cause and impact analysis, which helps you understand the extent and severity of any alert and further determine actions to respond to the alerts.

The following table outlines the actions available on the Alert View screen.

Action

Description

Filter alert data

Use the search text box and the following drop-down lists to filter alert data:

  • Status: The current status of the alert or investigation triggered in Workbench

  • Created: The time range during which Trend Vision One generated the alert

  • Model: The detection model that triggered the alert

  • Data source / processor: The product that is providing the data to the Workbench app

View and sort alerts

View the table to check all the alerts. Click column headings to sort alerts, for example, click Score to prioritize the alerts for further investigation.

Change the view

Select an option from the View drop-down list:

  • All: Shows all the alerts that match the filter criteria

  • Group by

    • Model: Groups the alerts by the detection model name

    • Endpoint: Groups the alerts by the endpoint name

    Click the right arrow () of each row to expand the alerts grouped by a specific model or endpoint name.

Change the alert status

Select one or more alerts and click Change Status to update the progress of alerts or investigations.

For more information, see Alert View Data.

Note:

If you select Closed - false positive, you need to specify why you think this alert was false.

Assign owner

Select one or more alerts and click Assign Owner to assign accounts within your organization to the alerts.

For more information, see Assigning Alerts.

Link alerts to an incident

After performing an alert investigation, select one or more alerts and click Link to Incident or Link to Another Incident to associate the selected alerts with the specified incident.

Note:
  • If an alert is manually linked to an incident or unlinked from an incident, Trend Vision One does not correlate the alert if a new alert is received.

  • An alert can only be associated with one incident.

Unlink alerts from an incident

After performing an alert investigation, select one or more alerts and click Unlink from Incident.

Note:

If an alert is manually linked to an incident or unlinked from an incident, Trend Vision One does not correlate the alert if a new alert is received.

View alert details

Click the Workbench ID link to view the summary, highlights and observable graph of the triggered alert.

For more information, see Alert Details.