The middle section of the alert details page contains information about the most recent event in this alert and about the triggering rule.
Most Recent Event—Details about the last event logged for this alert.
Click the down arrow next to a field value in this area to display a pivot menu. See Pivoting from event data.
A fraction appears for some fields. The value on the top (left) of the fraction indicates how many antivirus search engines found this field value to be malicious. The value on the bottom (right) of the fraction identifies the number of antivirus search engines that matched the field value. For example, (
37/60) indicates that a field value was found to be potentially malicious by 37 out of 60 matching antivirus engines.If an "i" appears for a field value, threat analysis information exists for the field. Click the "i" icon to see associated threat analysis information on the Intel tab. See Viewing intelligence details on alerts.
Click URL Screenshot in the virus field to see a preview of the Web page pointed to by a URL in a phishing email.
Helix Enterprise Rule
Name—A link to the rule that triggered this alert.
Rule Pack—The rule pack to which this rule belongs, if any.
Distinguishers—A field in an event that a rule uses to differentiate hits for the purpose of creating alerts. See About distinguishers for more information.
Threshold—The threshold set by the rule.
Interval—The interval set by the rule.
Query—A link to the TQL query that produced the event.
Managed Defense—Information from Managed Defense is displayed in this section for up to five mapped alerts, in order of severity.
Severity—The severity of this alert.
Status—The investigation status.
Disposition—The alert disposition.
Threat Type—Threat details.
Threat Actors—Threat actors.
Malware—Malware information for the alert.
Note
This section is displayed only if you subscribe to Managed Defense and Trellix enabled the integration with Helix Enterprise. A "no alerts found" message is displayed if Managed Defense has no information about the alert.