General information about the incident.

Click Edit to modify the following information:

• Incident Number: The unique incident ID.
• Incident Date/Time: The date and time that the incident was created.
• Incident Category: The incident category, including Unauthorized Access, Denial of Service (DoS), Malicious Code, Improper Usage, Scans/Probes/Attempted Access, and Uncategorized.
• Severity: The severity of the incident, including High, Medium, and Low.
• Status: The current status of the incident, including New, Analysis, Response, Closed: Remediated, and Closed: False Positive.
• Affected Endpoint: The endpoint associated with this incident.
• Description: A description of the incident provided by the administrator.
• Assigned To: A dropdown menu of administrators to which the incident can be assigned.

Click Refresh to manually update the displayed information.

The history of executed playbooks related to the incident.

Click Execute Playbook to run a playbook configured with the On_Demand trigger. See FortiSoC.

Displays the history of changes made to an incident, including the user who made the change and information about the type of change that was made.

Click Expand All to see additional details.

The timeline of the events raised for the incident.

Scroll using your mouse wheel to change the displayed time frame.

Displays comments made by administrators for this incident with a timestamp. The most recent comments appear at the top of the list.

Enter a comment and click POST to create a new comment.

Existing comments can be edited and deleted by administrators.

Displays the events that have been raised for this incident.

Attach and manage reports related to this incident.

See Adding reports to an incident.

Displays indicators attached to an incident from FortiGuard, FortiMail, or event handlers.

Hover your mouse over an indicator to view detailed information from FortiGuard or click Details under Results to view information from FortiMail including sender reputation and email statistics.

Indicator information can be attached to incidents using the FortiGuard and FortiMail connector in FortiSoC playbooks, or when an incident is created from an event that includes indicators identified in the event handler.

Displays affected asset(s) in a table. Includes the host, user, IP address, and MAC address of the asset.

Selecting a user shows endpoint information in a window.

Displays endpoint processes associated with this incident including the process ID, process path, and network connection.

Select a time period to view by choosing a snapshot from the snapshot dropdown.

Processes can be displayed in a table format or as raw data.

Displays endpoint software associated with this incident including the software, installation path, and installation time.

Select a time period to view by choosing a snapshot from the snapshot dropdown.

Software can be displayed in a table format or as raw data.