Detections details
The Detection Details page provides a consolidated view of suspicious or malicious activity on your network. It helps you quickly understand what happened, which devices were involved, and how severe the threat may be.
This page brings together all key information needed to investigate a security event. You can see the affected device, the type of threat detected, when the activity occurred, and how the activity fits into the larger attack sequence. A visual timeline highlights the order of events, making it easier to trace how the behavior developed. You can also review related detections that may indicate a multi‑stage attack, such as downloader activity, payload execution, or credential‑theft tools.
For deeper investigation, the page includes context about past detections on the same device, as well as a full list of raw network events that contributed to the alert. This enables you to verify the detection, understand its impact, and determine the appropriate next steps.
To view the device details page:
| Dashboard | In the High Risk Devices widget, hover over a line in the chart and click Detection Detail. |
| Detections |
|
| Detections Device Timeline | Hover over a line in the chart and click Detection Detail. |
Use the items in the tool bar to start an Investigation, resolve and assign detections, and mute detections and devices. Click any IP address in the page to open the Entity Panel.
The Device Details page contains the following widgets:
| Widget | Description |
|---|---|
| Devices |
Displays the source and destination IP addresses involved in the detection, along with the risk score and annotations that describe the traffic or detection type. Additional information such as geolocation, integrations including FortiEDR and FortiManager, hostnames, and PDNS is also shown when available. |
| Incident Event Timeline | Shows timestamps for each event so you can follow the sequence of actions that led to the detection. Select an event in the timeline to view the related device details in the Devices widget. This helps with incident reconstruction and triage. |
| Detection Overview |
Shows all the available information related to the detector and the detection. The first row of cards provides information about the detector. Click the detector name to view the detector details. From here, you can pivot to the Detection Details page. The subsequent rows provide information about the current detection. Hover over the sensor name to view more information, or click it to open the sensor’s details page. The detector description and next steps are displayed when available. |
| Event Details Panel |
Shows the event type associated with the corresponding event selected in the Incident Event Timeline. More details are shown when the event type is Observation, Suricata, and DPI. And if there are Intel Hits, intel hits details will also be shown. |
| Resolution History & Context |
Displays charts and detection context cards that show how the current detection fits into broader device and network activity.
|
| More information |
The More Information section has three tabs:
|