Alert Summary bar
The alert summary bar, shown at the top of the page, gives a quick overview of the selected alert. It highlights key details like type, severity, and status, to quickly understand the alert without going through the raw data. It saves time and makes it easier to decide what action to take next.
Alert Details
The Alert Details view, is a key part of any security operations platform, serving as a critical starting point for any subsequent investigation or response actions. Unlike a summary list, this view dives deep into one alert providing a high-level understanding of its nature.
You can gain immediate and comprehensive understanding of what happened, how NDR detected an alert, what specific vulnerability was targeted, and what is the adversary objective.
Description of alert
This panel provides a short summary of the detected alert, explaining its security impact and the key technical details needed to guide an investigation.
Next Steps
This panel provides a clear, step-by-step checklist that guides you through the standard investigation process. It ensures a consistent and thorough response to the alert enabling faster incident response and resolution.
Conversation map
This panel provides a visual representation of network communications related to a security event. This graph helps you understand the relationships between a central host and other devices, as well as the flow of network traffic. Trellix NDR visualizes these network communications to provide threat context and enable analysts to quickly identify potential lateral movement paths.
Attacker IP
This panel provides a summary of information related to a host identified as a potential attacker in a security event. This panel helps you to quickly understand the context and the origin of a malicious threat. You can use this information to look for related threats, check other systems, and block the attacker using security tools like firewalls.
Victim IP
This panel provides a summary of information related to a host identified as a victim in a security event. This panel helps you to quickly understand the context of the compromised asset. You can use this information to check for damage, look at logs, and take steps to protect the affected system.
Events
The Events panel provides a timeline of network security events detected by NDR. It presents a concise, chronological view of activity, helping you quickly identify and investigate potential threats.
