You'll be excited to hear that we released an additional tab under the Risks view of our product, to enable Incident Management. The Incidents tab surfaces the highest fidelity alerts that should be prioritized in terms of investigations and/or proactive hunting and enables management of those incidents.
Here's what you need to know about this new tab:
What are the Key features?
- Visualization - dashboards and tables summarizing incidents
- Creation - create/edit incidents, manually or automatically
- Notification - set up notification options (Ticketing, Slack, Email, etc.)
- Workflow - assign & change status of incidents
- Investigations - investigate incidents, pivot to alerts, search, or the graph canvas
What dashboards are available?
- View Incidents by status and priority
- View trending metrics, such as # of open incidents over time
- Filterable table with time, description, priority, status, affected entities, and more
How are Incidents created?
- Incidents can be created manually from one or more individual alerts
- Alert clusters, which are chains of interrelated alerts, automatically create incidents by default
- Rules and anomalies can be configured to create incidents (for example, create an incident for all critical Wildfire alerts)
What notification options are available?
- Out of the box notification options include Email, Slack, ServiceNow
- Users can add their own integrations or request additional integrations
What workflow is enabled?
- Users can sort incidents by time and priority
- Users can assign incidents to users of Sift Security
- Users can change the stage of incidents (e.g. Analysis, Remediate, Closed)
- Users can provide feedback on the incident (e.g. False Positive)
What investigations and remediation capabilities are possible?
- Users can see all the alerts that constitute an Incident
- Users can see the raw details in Search
- Users can investigate the Incident using the Graph Canvas, visualizing the alerts and context
- Users can select from out of the box integrations to take action
- Users can add custom integrations to facilitate remediation
For further reading, check out docs.siftsecurity.com, and learn more about how to take advantage of these new incident management capabilities.