Analyzing an incident

In FortiSoC/Incidents & Events > Incidents, double-click an incident or right-click an incident and select Analysis.

The analysis page shows the incident's affected endpoint and user, audit history, attached events, reports, comments, and more.

In the incident information panel, you can change information collected about the incident.

In order to assist SOC analysts during their investigation, information including comments and reports can be attached to incidents.

In the Events panel, you can review and delete events attached to the incident. See Raising an incident.

The Analysis page includes the following information and features:

Panel	Description
Incident information	General information about the incident. Click Edit to modify the following information: Incident Number: The unique incident ID. Incident Date/Time: The date and time that the incident was created. Incident Category: The incident category, including Unauthorized Access, Denial of Service (DoS), Malicious Code, Improper Usage, Scans/Probes/Attempted Access, and Uncategorized. Severity: The severity of the incident, including High, Medium, and Low. Status: The current status of the incident, including New, Analysis, Response, Closed: Remediated, and Closed: False Positive. Affected Endpoint: The endpoint associated with this incident. Description: A description of the incident provided by the administrator. Assigned To: A dropdown menu of administrators to which the incident can be assigned. Click Refresh to manually update the displayed information.
Affected Endpoint/User	Information about the affected endpoint/user. When multiple endpoints/users are associated with the incident, the total number is displayed and you can click the forward or backwards arrow on the tile to cycle between them.
Executed Playbooks	The history of executed playbooks related to the incident. Click Execute Playbook to run a playbook configured with the On_Demand trigger. See FortiSoC.
Audit History	Displays the history of changes made to an incident, including the user who made the change and information about the type of change that was made. Click Expand All to see additional details.
Incident Timeline	The timeline of the events raised for the incident. Scroll using your mouse wheel to change the displayed time frame.
Comments	Displays comments made by administrators for this incident with a timestamp. The most recent comments appear at the top of the list. Enter a comment and click POST to create a new comment. Existing comments can be edited and deleted by administrators.
Events	Displays the events that have been raised for this incident.
Reports	Attach and manage reports related to this incident. See Adding reports to an incident.
Indicators	Displays indicators attached to an incident from FortiGuard and FortiMail. Hover your mouse over an indicator to view detailed information from FortiGuard or click Details under Results to view information from FortiMail including sender reputation and email statistics. Indicator information can be attached to incidents using the FortiGuard and FortiMail connector in FortiSoC playbooks.
Affected Assets	Displays affected asset(s) in a table. Includes the host, user, IP address, and MAC address of the asset. Selecting a user shows endpoint information in a window.
Processes	Displays endpoint processes associated with this incident including the process ID, process path, and network connection. Select a time period to view by choosing a snapshot from the snapshot dropdown. Processes can be displayed in a table format or as raw data.
Software	Displays endpoint software associated with this incident including the software, installation path, and installation time. Select a time period to view by choosing a snapshot from the snapshot dropdown. Software can be displayed in a table format or as raw data.
Vulnerabilities	Displays endpoint vulnerabilities associated with this incident including the vulnerability name, ID, severity, and category. Select a time period to view by choosing a snapshot from the snapshot dropdown. Vulnerabilities can be displayed in a table format or as raw data.

Some features of incident analysis are only available with the applicable license.

Analyzing an incident

In FortiSoC/Incidents & Events > Incidents, double-click an incident or right-click an incident and select Analysis.

The analysis page shows the incident's affected endpoint and user, audit history, attached events, reports, comments, and more.

In the incident information panel, you can change information collected about the incident.

In order to assist SOC analysts during their investigation, information including comments and reports can be attached to incidents.

In the Events panel, you can review and delete events attached to the incident. See Raising an incident.

The Analysis page includes the following information and features:

Panel	Description
Incident information	General information about the incident. Click Edit to modify the following information: Incident Number: The unique incident ID. Incident Date/Time: The date and time that the incident was created. Incident Category: The incident category, including Unauthorized Access, Denial of Service (DoS), Malicious Code, Improper Usage, Scans/Probes/Attempted Access, and Uncategorized. Severity: The severity of the incident, including High, Medium, and Low. Status: The current status of the incident, including New, Analysis, Response, Closed: Remediated, and Closed: False Positive. Affected Endpoint: The endpoint associated with this incident. Description: A description of the incident provided by the administrator. Assigned To: A dropdown menu of administrators to which the incident can be assigned. Click Refresh to manually update the displayed information.
Affected Endpoint/User	Information about the affected endpoint/user. When multiple endpoints/users are associated with the incident, the total number is displayed and you can click the forward or backwards arrow on the tile to cycle between them.
Executed Playbooks	The history of executed playbooks related to the incident. Click Execute Playbook to run a playbook configured with the On_Demand trigger. See FortiSoC.
Audit History	Displays the history of changes made to an incident, including the user who made the change and information about the type of change that was made. Click Expand All to see additional details.
Incident Timeline	The timeline of the events raised for the incident. Scroll using your mouse wheel to change the displayed time frame.
Comments	Displays comments made by administrators for this incident with a timestamp. The most recent comments appear at the top of the list. Enter a comment and click POST to create a new comment. Existing comments can be edited and deleted by administrators.
Events	Displays the events that have been raised for this incident.
Reports	Attach and manage reports related to this incident. See Adding reports to an incident.
Indicators	Displays indicators attached to an incident from FortiGuard and FortiMail. Hover your mouse over an indicator to view detailed information from FortiGuard or click Details under Results to view information from FortiMail including sender reputation and email statistics. Indicator information can be attached to incidents using the FortiGuard and FortiMail connector in FortiSoC playbooks.
Affected Assets	Displays affected asset(s) in a table. Includes the host, user, IP address, and MAC address of the asset. Selecting a user shows endpoint information in a window.
Processes	Displays endpoint processes associated with this incident including the process ID, process path, and network connection. Select a time period to view by choosing a snapshot from the snapshot dropdown. Processes can be displayed in a table format or as raw data.
Software	Displays endpoint software associated with this incident including the software, installation path, and installation time. Select a time period to view by choosing a snapshot from the snapshot dropdown. Software can be displayed in a table format or as raw data.
Vulnerabilities	Displays endpoint vulnerabilities associated with this incident including the vulnerability name, ID, severity, and category. Select a time period to view by choosing a snapshot from the snapshot dropdown. Vulnerabilities can be displayed in a table format or as raw data.

Some features of incident analysis are only available with the applicable license.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

Administration Guide

Analyzing an incident