Investigating Incidents
The Incidents section helps you filter, investigate and take actions on all security events detected by Incidents Sensor over a specific time interval.
This section contains the following features:
Incidents: view and investigate incidents.
Blocklist: manage blocked files from incidents.
Custom rules: create custom rules for exclusions or detections
Note
Availability and functioning of these features may differ depending on the license included in your current plan.
The Incidents page
Use the Incidents page to filter and manage security events.
This page contains the following areas:
A window bar with tabs that include different incident types:
Endpoint Incidents: displays all suspicious incidents detected at endpoint level, that require investigation and upon which no action was taken yet.
Detected Threats: displays all security events identified as threats by GravityZone prevention modules. These incidents are detected at endpoint level and are acted upon with actions predefined in the security policies applied to your environment.
Filtering options to customize your grid:
Click the
Show/Hide Columns button to add or remove filter columns.Click the
Show/Hide Filters button to show or hide the filters bar.Click the Clear button to reset all filters.
The Incidents grid, which displays a list of security events according to the applied filters.
Incidents Overview bar
The Overview bar lists open incidents, top alerts, affected devices, among other relevant data, to give you a quick view of the overall situation on the threats your environment is facing.
Filtering incidents from the Overview bar
You can filter the incidents list by selecting values in the Overview bar:
If you click a value in the Open incidents section it will display only the incidents with the selected level of severity.
If you click a value in the Top alerts section it will populate the search field with the alert name and display only the incidents where the alert was detected.
If you click a value in the Top techniques section it will populate the search field with the technique name and display only the incidents where the technique was detected.
If you click a value in the Top affected devices section, it will display only the incidents affecting the selected device.
The Filters grid
The Incidents page allows you to choose what incidents to display by customizing the filters grid.
Click the
Show/Hide Columns button to add or remove filter columns.Click the
Show/Hide Filters button to show or hide the filters bar.Click the Clear button to reset all filters.
Find details of the available filtering options in the following table:
Filtering option | Details |
|---|---|
Severity Score | The Severity Score is a number between 100 and 10, indicating how potentially dangerous a security event is. The higher the score, the more certain the event is dangerous. It provides context based on the attack indicators, and ATT&CK Techniques, if applicable. To filter by the severity score, drag the slider bar to the chosen values. Or, you can use the number fields below the slider bar. Click OK to confirm the score selection. See Severity Score for details on how GravityZone calculates the Severity Score. |
Date | To filter by date:
|
Status | Filter the incidents by their current status by checking one or more of the status options available in the drop-down menu:
|
ID | Narrow the incident list by searching a specific security event ID number. |
Endpoint | Narrow the incident list by searching a specific endpoint name from your managed network. |
Attack Type | The attack type is a dynamic list of the most common types of attack, which changes based on the attack indicators found in the listed security events. |
Alerts | This column displays the number of alerts triggered per incident. |
Endpoint OS | This option filters the security events by operating system of involved endpoints. |
Priority | This column indicates the priority of each incident. |
Assigned to | This column indicates the user that the incident is assigned to. |
Note
Filtering options may vary depending on the type of license key included in your current plan.
To search for more elements that are not visible in the filter grid, select one of the search options from the drop-down menu:
Alert name - 2 to 1,000 max. characters
Endpoint IP - 45 max. characters
MD5 - 32 max. characters
SHA256 - 64 max. characters
Node name - 360 max. characters
Username - 1,000 max. characters
The page will update automatically, loading only the security event cards matching the searched element. For a more granular search, you can create search queries in the Search page.
Viewing security events
The Incidents page displays a list of security events matching the selected filters.
By default, there are 20 events per page, bundled by date. The page auto-refreshes at regular intervals, as EDR triggers new events.
Each security event entry is listed in a rich card format, providing an overview of each incident, with information based on the selected filters.
Important
All security events older than 90 days are automatically deleted from the grid, and also from the security events repository, be it a complex incident or incidents detected at endpoint level.
Click the View Graph button to access the graphic visualization of the incident.
Click the View Events button to access the timeline of events comprising the incident .
Changing the Status of Security Events
The investigation status helps you keep track of incidents that have already been investigated, and marked as closed or false positive, incidents that are currently under investigation, and open, or new incidents that have yet to be analyzed.
Follow these steps to change the status of one or multiple security events at a time:
Check the boxes of the security event cards that will undergo a status change.
You can select them individually or by using the bulk selection options in the drop-down menu.
Note
You can also browse through several security event pages while keeping your selection.
Click the Change Status button.
Select the status option:
Open - when the security event is not yet under investigation.
Investigating - when you have started investigating the event.
False Positive - when you analyzed the event and identified it as a false positive.
Closed - when you have done investigating.
A box will open when changing the status of security events to False Positive or Closed, where you can leave a note on the reasons for changing the event status, for later consultation.
The note will be appended to the ones already existing inside the filtered incidents.
Click Confirm to apply the selected status option.
Investigating an Endpoint Incident
The Endpoint Incidents tab displays all suspicious incidents detected at endpoint level, that require investigation and upon which no action was taken yet.
In the Endpoint incidents tab, identify the security event you want to analyze from the incidents grid.
Use the View Graph button in the incident card to open the Incident graph in a new page, or
Select a security event card to open its details panel for a quick look at the most important attack indicators of that incident.
After opening the incident graph you can see sequence of events that led to triggering the incident, and provides options to take remediation actions.
By default, the graph highlights the Critical path of the incident, and the event that triggered the incident.
Start analyzing the information displayed in the details panel of the trigger node, to find what is the root cause of the incident.
In the panel you can find valuable info like the alerts detected on the trigger node, the date and time of the event, and command lines that were executed by the attacker.
If the situation allows it, select the Add to Sandbox button to detonate suspicious or malicious elements and see the Sandbox report to evaluate the damage they may have cause to your environment.
Tip
To make sure you didn't miss anything investigate the incident nodes on the same level as the trigger node.
You can continue to analyze the other elements constituting the critical path until you get a clear picture of what caused the incident.
If the threat is real take appropriate actions to mitigate it. Learn more about available actions in Node details.
If the threat is not real you can go to the Status menu at the top of the graph and set the status of the incident to False positive, and start investigating the next incident in the list.
Note
You can use the Notes clipboard to leave insights about the incident, to provide context in case other users reopen the incident.
When further investigation is needed, navigate to the Events tab to see all the raw events and alerts that were spawned as part of the incident under investigation.
Graph
The Graph provides an interactive graphical representation of the investigated incident and its context, highlighting the sequence of elements directly involved in triggering it, known as the Critical path of the incident, as well as all the other elements involved, faded out by default.
The Graph includes filtering options that allow the customization of the incident graphic to improve visualization, and details panels with more information about each element, to facilitate the investigation of what happened in your environment.
Critical path
The Critical path is the sequence of linked security events that have led up to setting off an alert, starting from the point of entry in the network down to the event node that triggered the incident.
The critical path of the incident is highlighted by default in the graph, along with all consisting event nodes. The trigger node easily stands out from the rest of the elements in the graph, and its info panel is displayed by default alongside the incident graph, providing detailed trigger node information.
Trigger Node
Node Details panel with collapsible information sections
Minimized nodes, indirectly involved in the incident
Tip
Selecting any other element than the trigger node will no longer highlight the critical path, and show the path to origin instead, from the selected node to the start of the incident.
This is what you need to know about security event nodes:
Each node represents a specific element involved in the investigated incident.
All nodes that make the critical path are shown by default in detail when you open the incident, while the other elements are faded out, to avoid cluttering the view.
Hovering over a node that is not part of the critical path will highlight it and show the path to the point of origin, without breaking the Critical Path.
Three or more same action type event nodes spawning from a parent node are grouped into an expandable cluster-node.
Only nodes without child elements will be hidden from the incident graph when the cluster-node is collapsed.
Nodes where suspicious activity has been detected will not be added to the cluster-node.
Clicking a node will display the following details:
It will highlight in blue the path to the endpoint node along with all the other involved elements.
A side panel with expandable sections that provide detailed information of the selected node, alerts in case detections are triggered, available actions and recommendations.
Nodes are linked by arrow-lines indicating the course of actions that occurred on the endpoint during the incident. Each line is labeled with the action name and its chronological number.
The following elements of an incident can be represented as nodes:
Node type | Description |
|---|---|
Endpoint | Displays endpoint details and patch management status. |
Domain | Shows information about the domain host and its endpoints. |
Process | Shows details about the process role in the current incident, file information, process executions details, network presence and further investigation options. |
File | Shows details about the file role in the current incident, file information, network presence and further investigation options. |
Registry | Displays Registry information and the parent process details. |
Note
Learn more about node details here.
Filters
The Filters menu provides you with enhanced filtering capabilities, allowing full manipulation of the incident graphic, by highlighting the elements based either on their type or relevance, or by hiding them to make the incident more compact and easier to analyze.
Click an hold the 
Drag icon to position the floating filters panel anywhere inside the incident graph.
When selecting an element-type filter:
The incident graphic zooms out and highlights all the elements of the selected type, while the elements of different type are faded out.
It instantly opens a panel with the list of all the highlighted elements.
Note
Selecting an element from the displayed list will highlight it in the incident graphic, and open a details panel with information related to that element.
Only one filter can be applied at a time.
Filtering options include:
Critical path: It highlights the critical path of the incident of compromise.
Endpoint: It highlights the endpoints affected by the incident.
Process: It highlights all process-type nodes involved in the incident.
File: It highlights file-type nodes involved in the incident.
Domain: It highlights all domain-type nodes involved in the incident.
Registry: It highlights all registry-type nodes involved in the incident.
Element relevance: You can also filter elements by their importance inside the incident.
Neutral node: Elements with no direct impact in the security incident.
Important node: Elements with relevant role in the security incident.
Origin node: Ground zero of the incident inside the network.
Suspicious node: Elements with suspicious behavior, directly involved in the security incident.
Malicious node: Elements that caused damage to your network.
You can also hide certain elements from the incident graph by clicking the Show/Hide button displayed when hovering over filters of the type: File, Domain, and Registry.
Hiding an element type redraws the incident graph by removing all corresponding elements, even if they are zoomed out, excepting the trigger node and nodes with child elements.
Navigator
The Navigator enables you to quickly move through the incident graph and explore all displayed elements by using the mini-map and the different levels of visualization. The Navigator is collapsed by default. When expanding it, the menu will display the miniaturized version of the entire incident map, and action buttons to adjust the level of visualization.
Click and hold the Drag icon to position the floating navigator panel anywhere inside the incident graph.
The Navigator makes it easy to adjust how you visualize the incident graph, through the use of the 
Fewer details and 
More details actions.
Note
In situations when the incident the graph expands beyond screen limits, hold and drag the map selector to the desired incident map area.
Node details
The Node details panel includes expandable sections with detailed information of the selected node, including preventive or remediation actions you can take to mitigate the incident, details on the type of detection and alerts detected on the node, network presence, process execution details, additional recommendations to manage the security event, or actions to further investigate the element.
To view this information and take actions within the panel, select a node within the security event map.
You can collapse the Node Details panel by clicking the Collapse button.
You can easily navigate the information displayed in the Node Details panel by clicking the icons pf each of the four major sections:
ALERTS. his section displays one or multiple detections triggered on the selected node, including details about the Bitdefender technology that included the element in the incident, the reason that triggered the detection, detection name, and the date when it has been detected.
INVESTIGATION. This section displays date stamps for the initial detection and all the endpoints where this element was spotted.
REMEDIATION. This section displays actions taken automatically by GravityZone, actions you can take immediately to mitigate the threat, as well as detailed recommendations for each alert detected on the selected node to assist you in mitigating the incident and increase the security level of your environment.
INFO. This section displays general information about each file, and specific information depending on the type of node selected.
You can drag the Node Details panel towards the center of the screen to easily go through its contents.
The Endpoint details panel includes two sections:
REMEDIATION. Displays info about the actions taken automatically by GravityZone to mitigate threats and actions you can take.
Note
The range of actions you can take may vary depending on the license included in your current plan.
Isolate Host - Use this remediation solution to isolate the endpoint from the network.
Install patches - Use this action to install a missing security patch on the target endpoint. This option is visible only with the Patch Management module, an add-on available with a separate license key. Learn more about installing patches here.
Remote Connection - use this action to to establish a remote connection to the endpoint involved in the current incident and run a number of custom shell commands directly on its operating system, for mitigating the threat instantly or collecting data for further investigation.
DEVICE INFO. Displays general information about the affected endpoint, such as endpoint name, IP address, operating system, pertaining group, state, active policies, and a link that opens a new window where full endpoint details are displayed.
It also provides with information such as the number of installed patches, failed patches, or any missing security and non-security patches.
In addition, you can generate an endpoint patch status report. This section is provided on demand for the target endpoint.
You can take the following actions within the panel:
View patch information for target endpoint. To view patch details, click the Refresh button.
View patch status report for target endpoint. To generate the report, click the View endpoint patch status report button.
The details panel for process nodes includes four sections:
ALERTS. Displays one or multiple detections triggered on the selected node, including details about the Bitdefender technology that included this entity in the incident, the reason that triggered the detection, detection name, and the date when it has been detected. The description for each alert follows the latest MITRE standards.
INVESTIGATION. Displays the date stamp for the initial detection and all the endpoints where this threat was spotted.
To view this list, click the number shown in the endpoints field and a new window will pop up.
This section also provides external analysis through internal components and third-party solutions.
The following actions are available:
Add to Sandbox - Use this action to generate a Sandbox Analyzer report.
Choosing Add to Sandbox prompts you with a screen to confirm file submission.
After confirmation, you are automatically redirected to the submission screen.
When the analysis is completed, click the View Sandbox Analyzer Report button to open the full report.
VirusTotal - Use this action to submit a file externally for analysis.
Google - Use this action to search online the hash value of a file.
REMEDIATION. Displays info about the actions taken automatically by GravityZone to mitigate threats and actions you can take.
Note
The range of actions you can take may vary depending on the license included in your current plan.
Kill - Use this action to stop a process execution. This action creates a kill process task visible in the process execution bar.
System32and Bitdefender processes are excluded from this action.Quarantine file - Use this action to store the item in question and prevent it from executing its payload. This action requires the Firewall module to be installed on the target endpoint.
Add file to Blocklist - Manage blocked items in the Blocklist page.
Note
Only users with GravityZone administrator role can add files to Blocklist.
Add file as exception - Use this option to exclude legitimate activity on a specific policy. When you choose this action, a configuration window prompts you to select the policy where you want to add an exception. Manage exclusion under Policies > Antimalware > Settings.
This section also provides detailed recommendations for each alert detected on the selected node to assist you in mitigating the incident and increase the security level of your environment.
PROCESS INFO. Displays details about the selected process node, including process name, executed command line, user, time of execution, file origin and path, hash value, or digital signature.
In this section you can copy the item's hash value to clipboard by clicking the available hashing algorithms within the Hash field, and add it to Blocklist.
Note
For more information, refer to Blocklisting files.
The File node details panel includes four sections:
ALERTS. Displays one or multiple detections triggered on the selected node, including details about the Bitdefender technology that included this entity in the incident, the reason that triggered the detection, detection name, and the date when it has been detected. The description for each alert follows the latest MITRE standards. Each alert detected on the selected node provides detailed recommendations to assist you in mitigating the incident and increasing the security level of your environment.
INVESTIGATION. Displays date stamps for the initial detection and all the endpoints where this element was spotted.
To view this list, click the number shown in the endpoints field and a new window will pop up.
This section also provides external analysis through internal components and third-party solutions.
The following actions are available:
Add to Sandbox - Use this action to generate a Sandbox Analyzer report.
Choosing Add to Sandbox prompts you with a screen to confirm file submission.
After confirmation, you are automatically redirected to the submission screen.
When the analysis is completed, click the View Sandbox Analyzer Report button to open the full report.
VirusTotal - Use this action to submit a file externally for analysis.
Google - Use this action to search online the hash value of a file.
REMEDIATION. Displays info about the actions taken automatically by GravityZone to mitigate threats and actions you can take.
Note
The range of actions you can take may vary depending on the license included in your current plan.
Quarantine file - Use this action to store the item in question and prevent it from executing its payload. This action requires the Firewall module to be installed on the target endpoint.
Add file to Blocklist - Manage blocked items in the Blocklist page.
Add file as exception - Use this option to exclude legitimate activity on a specific policy. When you choose this action, a configuration window prompts you to select the policy where you want to add an exception. Manage exclusion under Policies > Antimalware > Settings.
FILE INFO. Displays details about the selected file node, including file origin and path, hash value, or digital signature.
In this section you can copy the item's hash value to clipboard by clicking the available hashing algorithms within the Hash field, and add it to Blocklist.
Note
For more information, refer to Blocklisting files.
The Registry node details panel includes three sections:
ALERTS. Displays the severity of the registry manipulation as marked by the Bitdefender technology that included this entity in the incident, the reason that triggered the detection, the date when it has been detected, and registry type.
REMEDIATION. Displays info about the actions taken automatically by GravityZone.
Note
The REMEDIATION section for registry nodes does not provide any user action option.
REGISTRY INFO. Displays details about the selected registry node, including registry key, value and data.
You can click the registry key and value to copy it to clipboard for further analysis purposes.
Search bar
The Search bar has two functionalities:
Search nodes. Click
and the search bar expands, allowing you to enter information and search the graph for particular nodes.Incident trigger. A direct link to the node that triggered the alert.
Events
Use the Events tab to view how the sequence of events unfolded into triggering the currently investigated incident. This window displays the correlated system events and alerts detected by GravityZone technologies such as EDR, Network Attack Defense, Anomaly Detection, Advanced Anti-Exploit, or Windows Antimalware Scan Interface (AMSI).
Note
The availability of technologies involved in the detection process may differ depending on the the license included in your current plan.
Every event has a detailed description explaining what was detected and what might happen if the artifact is used for malicious purposes, in accordance with the latest MITRE techniques and tactics.
Use the filtering options to display all events, or group them by Att&ck tactics. You can also use the search bar to find events, after predefining their category. The grid is populated with the sorted events.
Select any event in the grid to open its side panel and analyze the major attack indicators, such as command line, network details, or other specific information.
Incident Info
This panel contains collapsible sections with details like incident ID, current state, time and date when the incident was created and last updated, number of involved artifacts, trigger name and description, and attack info.
The panel also includes the alerts detected on the element that triggered the incident.
Remediation
The Remediation panel provides you insightful information about what corrective actions were taken automatically by GravityZone in case of attacks blocked by technologies such as Advanced Threat Control (ATC), HyperDetect, Antimalware, as well as recommended steps you may follow in order to mitigate the incident and to increase the security level of your system.
Actions taken automatically by GravityZone.
Recommendations to further mitigate the incident and boost security posture.
Note
The recommended steps correspond to the alerts detected on the node that triggered the investigated incident.
Incident Status Bar
The incident status bar provides security event tags that can help you detect key information about the involved network endpoints.
Incident ID - the id number of the incident under investigation and if the incident is either blocked or reported.
Detection timestamp - the date and time the incident was triggered.
Status - the current incident status.
Assignee - the user that the incident is assigned to.
Priority - the priority of each incident.
Access icons and their description:
Notes clipboard
The Notes clipboard provides an easy way to add notes to incidents for tracking changes and incident ownership.
Displaying notes
To display a list of available notes click the Notes button on the right side of the Status bar:
Note
Alongside each note, the user name of it's creator will be displayed. If the user belongs to a partner company, the name Partner will be displayed instead.
Adding a note
To add a note, follow the steps below:
Click the Add note button on the lower rights side of the clipboard.
Fill in the note information.
Note
Each note can contain up to of 2,048 characters.
Select Save.
Note
In case of bulk actions, a single note will be added in bulk for all incidents.
Editing a note
To edit a note, follow the steps below:
Select the Menu button on the right side of the note you wish to edit.
Select Edit.
Make the necessary modifications:
Note
Each note can contain up to of 2,048 characters.
Select Save.
Note
If you wish to cancel editing the note, click Cancel, then select Discard.
Deleting a note
To delete a note, follow the steps below:
Select the Menu button on the right side of the note you wish to delete.
Select Delete.
Note
This option is only available for your own notes.
Select Delete again.
History Clipboard
The History panel provides an easy way to track the history of an incident. The following events are tracked:
Status changes
Assigning or reassigning an incident
Setting or changing an incident's priority
Adding, editing, or deleting an incident note
Creating an incident
Updating an incident
The list is displayed in chronological order from newest at the bottom to oldest at the top:
Each event will contain the following information:
The type of the event
A description of the event
The date and time on which the event occurred
The username of the person who performed the action
Note
If the user belongs to a partner company, the name
Partnerwill be displayed instead.
Remote Connection
Use this tab to establish a remote connection to the endpoint involved in the current incident and run a number of custom shell commands directly on its operating system, for canceling the threat instantly or collecting data for further investigation.
The Remote Connection tab contains the following items:
The name of the endpoint involved in the current security event.
The button controlling the remote connection (connect / disconnect).
The terminal window.
The version of Bitdefender agent installed on the endpoint supports the Remote Connection feature.
The endpoint must be powered-on and online.
The endpoint must have Windows OS.
GravityZone is able to communicate with the endpoint.
Your GravityZone account must have manage permissions for the target endpoint.
Start the live session by clicking the Connect to Host button.
The connection status will be displayed next to the endpoint name.
If the connection fails, an error message will be displayed in the terminal window.
Note
You can open maximum five terminal session with the same endpoint simultaneously.
Once connected, the terminal displays the list of available commands and their description.
Type the command that you want in the terminal window followed by
Enter.Note
To learn more about a command, type
helpfollowed by the command name (for example,help ps).The terminal displays the command output, when the command is successful.
If the endpoint fails to complete the command execution, the command will be discarded.
To end the connection, click the End Session button.
The terminal session expires automatically after five minutes of inactivity.
By navigating outside the Remote Connection tab while connected to an endpoint will also end the terminal session.
Terminal Session Commands
EDR terminal session commands are custom-built shell commands, platform independent, using a generic syntax. Find hereinafter the list of available commands you can use on endpoints through the terminal session: