WEBVTT

1
00:00.000 --> 00:05.630
So now that the 40 Analyzer has incidents that were either created or raised

2
00:05.630 --> 00:06.640
from existing events

3
00:06.640 --> 00:11.460
or manually created by an administrator or were automatically created as a

4
00:11.460 --> 00:12.400
result of an event

5
00:12.400 --> 00:16.200
handler, how do we now work with and manage those incidents? And that's the

6
00:16.200 --> 00:17.280
topic of this video.

7
00:17.280 --> 00:21.100
So let's head over to the 40 Analyzer and let's begin. So here we are at the 40

8
00:21.100 --> 00:21.920
Analyzer to get

9
00:21.920 --> 00:25.620
to our instance. We'll go to instance and events on this version of the 40

10
00:25.620 --> 00:26.880
Analyzer, which is version

11
00:26.880 --> 00:32.160
7.63 and under instance and events, we'll go to incidents. So at the top, we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:26.880 --> 00:32.160
7.63 and under instance and events, we'll go to incidents. So at the top, we

12
00:32.160 --> 00:33.040
have three tabs,

13
00:33.040 --> 00:37.110
we have incidents, then there's the MITRE attack option and then we have the

14
00:37.110 --> 00:38.960
MITRE attack ICS.

15
00:38.960 --> 00:43.190
ICS stands for industrial control systems like SCADA systems and so forth. So

16
00:43.190 --> 00:43.840
starting in the

17
00:43.840 --> 00:48.380
far left tab right here of instance, we have our charts, we can go ahead and

18
00:48.380 --> 00:49.040
not show those charts

19
00:49.040 --> 00:51.740
if you don't want to see them or we can show those charts or we can control

20
00:51.740 --> 00:52.880
which charts are shown.

21
00:52.880 --> 00:57.390
So currently we have two of the severe one that's medium and none of the low

22
00:57.390 --> 00:58.000
and that severity

23
00:58.000 --> 00:58.160
column is shown right here. Also, when new incidents show up, if it's

24
00:58.160 --> 01:01.680
associated with their
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:58.160 --> 01:01.680
associated with their

25
01:01.680 --> 01:06.010
credit automatically, we probably want to alert somebody. So in addition, there

26
01:06.010 --> 01:06.640
's an option here

27
01:06.640 --> 01:10.670
regarding incidents. If we click on more and go to settings, we can also

28
01:10.670 --> 01:12.480
specify to send notifications.

29
01:12.480 --> 01:16.320
So to do this, we'd have to set up actual destinations like syslog servers or

30
01:16.320 --> 01:17.600
SNMP and email and so

31
01:17.600 --> 01:22.450
forth. And then when they are, we can select that destination, for example,

32
01:22.450 --> 01:23.440
email or some other

33
01:23.440 --> 01:27.900
destination and then specify that notification should be sent when an incident

34
01:27.900 --> 01:28.880
is created or

35
01:28.880 --> 01:32.270
incident is updated or an incident is deleted. And that way, you can make sure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:28.880 --> 01:32.270
incident is updated or an incident is deleted. And that way, you can make sure

36
01:32.270 --> 01:33.600
the right people know

37
01:33.600 --> 01:37.220
about the incidents that are happening. So we'll click on cancel there. So if

38
01:37.220 --> 01:38.560
we need to modify or

39
01:38.560 --> 01:42.560
edit an incident, we can, for example, if we click here and just right click

40
01:42.560 --> 01:43.600
and you can click on

41
01:43.600 --> 01:47.240
edit, there's also an edit button right there that allows you to edit it, which

42
01:47.240 --> 01:48.000
we could use to go

43
01:48.000 --> 01:52.290
ahead and modify some of the details, including the name or the category or the

44
01:52.290 --> 01:53.280
MITRE Tech ID or

45
01:53.280 --> 01:56.600
severity and comments and so forth. So we'll make no changes for the moment. We

46
01:56.600 --> 01:57.840
'll click on cancel.

47
01:57.840 --> 02:01.460
There's an option for analysis, which is also available by right clicking and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:57.840 --> 02:01.460
There's an option for analysis, which is also available by right clicking and

48
02:01.460 --> 02:02.000
then from the drop

49
02:02.000 --> 02:05.090
down clicking on analysis or clicking on it here. So let's go ahead and do that

50
02:05.090 --> 02:05.920
. Another way of

51
02:05.920 --> 02:09.700
getting into the analysis for an incident is simply to double click and that

52
02:09.700 --> 02:10.960
also takes you to the

53
02:10.960 --> 02:16.020
incident analysis. Now there's also options for enrich and block. Now if you

54
02:16.020 --> 02:17.680
have set up, for example,

55
02:17.680 --> 02:22.120
the 40 analyzer to interact and work with virus total, the enrich option will

56
02:22.120 --> 02:22.960
reach out and get

57
02:22.960 --> 02:26.350
that additional information. For example, especially if it's virus related to

58
02:26.350 --> 02:27.520
give you more information

59
02:27.520 --> 02:30.440
or if we have for the manager set up and we're using for the manager to manage
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:27.520 --> 02:30.440
or if we have for the manager set up and we're using for the manager to manage

60
02:30.440 --> 02:31.760
all of our devices,

61
02:31.760 --> 02:35.880
we can also implement a block which leverages for the manager to put a block.

62
02:35.880 --> 02:36.480
So here in the

63
02:36.480 --> 02:39.850
incident analysis, there's multiple widgets and you can also control how it

64
02:39.850 --> 02:40.880
looks. So if we click

65
02:40.880 --> 02:44.720
right here and edit layout, for example, if you want to go ahead and you just

66
02:44.720 --> 02:45.600
have one column

67
02:45.600 --> 02:49.220
and then scroll all the way down here on the far right, see all the various

68
02:49.220 --> 02:50.480
widgets we can,

69
02:50.480 --> 02:54.370
or if you want to have two columns or three columns and so forth, just control

70
02:54.370 --> 02:55.040
it right there and

71
02:55.040 --> 02:58.390
then click on save. If you want to export the incident, there's great options

72
02:58.390 --> 02:59.280
for that as well.

73
02:59.280 --> 03:04.380
Just click on export and then you can export it as an HTML or a PDF document
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:59.280 --> 03:04.380
Just click on export and then you can export it as an HTML or a PDF document

74
03:04.380 --> 03:05.200
that's basically the same

75
03:05.200 --> 03:09.440
information that's being shown right here. There's also an option here to

76
03:09.440 --> 03:10.480
execute playbook. We'll

77
03:10.480 --> 03:13.860
have a separate set of videos regarding playbooks and automation and that can

78
03:13.860 --> 03:14.400
also be helpful in

79
03:14.400 --> 03:17.840
getting more information regarding this incident and based on the type of

80
03:17.840 --> 03:18.480
incident, there's also

81
03:18.480 --> 03:21.740
option here to run a report. There's also a quarantine option for assuming you

82
03:21.740 --> 03:22.240
have the right

83
03:22.240 --> 03:25.570
connectors in place and the right software running at those endpoints to make

84
03:25.570 --> 03:26.640
that happen. Also,

85
03:26.640 --> 03:30.830
if other admins are working on this or updating it, you can click on refresh to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:26.640 --> 03:30.830
if other admins are working on this or updating it, you can click on refresh to

86
03:30.830 --> 03:31.280
make sure we're

87
03:31.280 --> 03:34.240
looking at the latest and greatest information. So I'm going to go ahead and

88
03:34.240 --> 03:35.120
edit the layout and

89
03:35.120 --> 03:38.430
put this in single columns. We have one widget at a time. I'll go ahead and

90
03:38.430 --> 03:39.440
save that. So our

91
03:39.440 --> 03:42.810
first widget here is the incident summary, which has the basic information

92
03:42.810 --> 03:43.840
regarding the incident.

93
03:43.840 --> 03:47.000
And so if we scroll down here, we can see all that detail. And then if we on

94
03:47.000 --> 03:48.160
the far right scroll

95
03:48.160 --> 03:52.410
down, we're then going down to the next widget. So here's the affected endpoint

96
03:52.410 --> 03:53.040
slash user,

97
03:53.040 --> 03:57.320
which is ad user to which is another great reason to do user authentication. So

98
03:57.320 --> 03:58.320
we can associate

99
03:58.320 --> 04:02.260
not just an IP address with the problem or the event, but also associate the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
03:58.320 --> 04:02.260
not just an IP address with the problem or the event, but also associate the

100
04:02.260 --> 04:03.840
user. So this user,

101
04:03.840 --> 04:08.470
which is at the address of 10, 20, 0, 1, 0, 2, or at least was at this point in

102
04:08.470 --> 04:09.440
time, it's a Linux

103
04:09.440 --> 04:13.210
client. And if we scroll down, we have the affected assets, which is this Linux

104
04:13.210 --> 04:14.240
client at this IP

105
04:14.240 --> 04:17.420
address with that Mac address. So here we can add comments. For example, we

106
04:17.420 --> 04:18.720
discover something new

107
04:18.720 --> 04:22.260
or run the middle of something we could add comments here that would become

108
04:22.260 --> 04:23.600
part of this incident

109
04:23.600 --> 04:27.230
as we scroll down. Here's the events widget, which is showing the actual events

110
04:27.230 --> 04:28.640
that went into this

111
04:28.640 --> 04:32.800
incident when we created it initially. Here's the instant timeline. So there's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
04:28.640 --> 04:32.800
incident when we created it initially. Here's the instant timeline. So there's

112
04:32.800 --> 04:33.600
the date range

113
04:33.600 --> 04:37.530
and it happened back here. It also happened here. And if playbooks had been run

114
04:37.530 --> 04:38.480
against this,

115
04:38.480 --> 04:42.240
it would show it here in the executed playbooks widget. And if we scroll down,

116
04:42.240 --> 04:42.960
we have an audit

117
04:42.960 --> 04:46.860
history widget. So the events attached to the incident were by admin on this

118
04:46.860 --> 04:47.680
date. And there's

119
04:47.680 --> 04:50.740
the incident number. Here's a section for reports that have been added to this

120
04:50.740 --> 04:51.600
incident. So at the

121
04:51.600 --> 04:55.140
moment, we don't have any reports. But for example, if we went down to reports,

122
04:55.140 --> 04:56.400
we said, you know what,

123
04:56.400 --> 05:00.140
let's go ahead and let's go to report definitions. There's a whole bunch of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
04:56.400 --> 05:00.140
let's go ahead and let's go to report definitions. There's a whole bunch of

124
05:00.140 --> 05:00.720
defaults. Let's

125
05:00.720 --> 05:05.590
imagine we wanted asset news reports. And let's go ahead and do an asset

126
05:05.590 --> 05:07.280
identity report. Let's

127
05:07.280 --> 05:11.210
right click on that. And we'll go ahead and run it. So that's running it. Then

128
05:11.210 --> 05:12.160
we go to generated

129
05:12.160 --> 05:16.080
reports and the report that we just ran should be here. It's just in a moment.

130
05:16.080 --> 05:17.280
There it is. So it's

131
05:17.280 --> 05:21.460
99% done. That's completely done. So we could then take that report, right

132
05:21.460 --> 05:23.120
click on it and add that

133
05:23.120 --> 05:26.980
to an existing incident. So click here on add to existing incident. And we want

134
05:26.980 --> 05:27.840
to add to this one,

135
05:27.840 --> 05:31.690
11, click on OK. Now that we've done that, let's go back to our incident and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
05:27.840 --> 05:31.690
11, click on OK. Now that we've done that, let's go back to our incident and

136
05:31.690 --> 05:32.560
events. Then there's

137
05:32.560 --> 05:37.210
further widgets for indicators, software, processes, vulnerabilities. So back

138
05:37.210 --> 05:38.080
at the incident, let's

139
05:38.080 --> 05:42.380
go ahead and edit it. And it's no longer new. Let's go ahead and say that we're

140
05:42.380 --> 05:43.360
in analysis mode

141
05:43.360 --> 05:46.720
here where we're trying to find out what's going on. And it's currently

142
05:46.720 --> 05:48.240
assigned to the admin. So

143
05:48.240 --> 05:52.300
click on OK. So now that we have this incident that's created in the next video

144
05:52.300 --> 05:53.200
, I'd like to walk

145
05:53.200 --> 05:56.460
you through taking it through the next few steps to help really find out what's

146
05:56.460 --> 05:57.600
going on. And

147
05:57.600 --> 06:00.000
update this incident and we'll do that next video.