Incident Workspace Widgets

If built-in techniques are not visible, navigate to the Monitor module and select the Enable Mitre Tactics checkbox.

Editing a Custom Field Value

To edit a custom field value, click on the custom field, make the edits, then click on the button to save.

Deleting a Custom Field

To delete a custom field, click on it, then click on the icon.

Clicking the View Event Details link opens the Event Details pop-up window containing the details of the event.

Each file card displays the file name, size, and unique incident file ID. Users can perform the actions Preview, Download, or Delete using the menu accessible through the icon.

Upload details, including the uploader's name and timestamp, are displayed at the bottom of each file card.

Users can edit the file description by clicking the text area and cancel or confirm changes using the and buttons at the bottom-right.

1. Click on the button or Add Finding button.

   

2. Click on the Data Table option.

   

3. Configure the table.

   

   1. Select a suitable category from the dropdown.

   2. Enter a descriptive header for the table.

   3. Provide a brief description to help other users understand the table's contents.

   4. Use the code snippet below to create the table.

      JSON

      {
        "Fields": [
          {
            "Title": "Sender Email",
            "Name": "sender_email"
          },
          {
            "Title": "Subject",
            "Name": "subject"
          },
          {
            "Title": "Timestamp",
            "Name": "timestamp"
          },
          {
            "Title": "Malicious Link",
            "Name": "malicious_link"
          }
        ],
        "Data": [
          {
            "sender_email": "suspicious_user@example.com",
            "subject": "Urgent: Verify Your Account",
            "timestamp": "2025-01-07T10:15:00Z",
            "malicious_link": "http://malicious.example.com/login"
          }
        ]
      }
      

4. Click on the button to save.

5. Confirm that the data table can be rendered properly.

   

6. (Optional) Click the Investigation tab to check if the newly added finding is also there.

   

1. Click on the button or Add Finding button.

   

2. Click on the HTML Rich Text option.

   

3. Add the content.

   

   1. Select a suitable category from the dropdown.

   2. Add the finding using the HTML Rich Text editor.

4. Click on the button to save.

5. Confirm that the content can be rendered properly.

   

6. (Optional) Click the Investigation tab to check if the newly added finding is also there.

   

   
   

Users can switch between views the Grouped View and Timeline View when reviewing findings.

Grouped View

In the grouped view, findings are organized into categories, such as Initial Findings and Data Enrichments.

Timeline View

In the timeline view, findings are displayed in chronological order from top to bottom, starting with the earliest added finding.

1. Click on the button.

   

2. Add the investigators.

   

   1. Search for and select the users to add by their names.

   2. Define their access level as constrained by stage tasks.

   3. Click on the + Add button.

1. Click on the button to delete the user.

   

2. Click on the button.

   

3. Modify the investigator's access level.

   

   1. Search for and select the user whose access level needs to be updated.

   2. Update their level of access.

   3. Click on the + Add button.

1. Click on the icon.

2. Add the data in JSON, then click on the button to save.

   

3. Confirm that the table can be rendered properly.

   

Exact incident creation date and time

Incident owner

Email address artifact

File artifact

Internal IP artifact

Clicking the icon opens a summary of the linked incident with the following information: the incident link, conclusion, and notes.

1. Hover over that playbook and click on the icon.

   

2. Enter a reason for unlinking, then click on the Unlink button.

   

1. Click the button beside the Tasks widget header or the Ad-hoc Task button in the header panel.

   
   

2. Fill in the Create Ad Hoc Task form as required.