Incident View

Trend Vision One creates incidents to group related alerts using advanced alert correlation and machine learning techniques.

Table 1.




The score that Trend Vision One assigns to the incident based on the aggregate scores from related alerts

Incident ID

A unique identifier for the incident

Click an incident ID to view detailed information.

For more information, see Incident Details.

Incident name

The name of the incident type

Click an incident ID to view a description of the incident.

Last updated

The date and time Trend Micro last updated the incident and the last update status

  • Incident created: Trend Vision One first created the incident

  • New alert correlated: An alert is correlated and associated with the incident

  • Incident merged: Trend Vision One created the incident by merging multiple incidents

  • Alert unlinked:One or more alerts were manually unlinked from the incident

  • Alert linked: One or more alerts were manually linked to the incident

Associated alerts

The total number of related alerts and the number of active alerts associated with the incident

Click the number to view the workbench ID for each associated alert. Click a workbench ID to view workbench details.

  • An active alert is an alert that is not closed.

  • An alert can only be associated with one incident.

Impact scope

The number of entities that the incident affects within the company network


The date and time Trend Vision One generated the incident


The Trend Vision One accounts in your organization assigned to the incident

Select one or more incidents and click Assign Owner to assign accounts within your organization to the incidents.

For more information, see Assigning Incidents.