Using Active Channel Menu Commands

Show Event Details

Use the Event Inspector to examine all the attribute details associated with the event.

Correlation Options

• Simple chain: Show this event's base and correlated event tree in the Event Inspector.

• Detailed chain: Show this event's base and correlated events in detail in a new active channel.

• Show triggering resource: Show the rule that triggered this event in the Rule Editor.

• Clear rule actions: Clears the list (if one is showing) of rule actions pending on the database.

Analyze in Channel

Create a temporary filter as required based on the field's highlighted event. The Analyze in Channel command uses the event's attribute type (its column heading), and the particular event's field value (for example, an exact IP address), to formulate simple filters based on these two factors. The filter's operators can include Create Filter [X = Y] and Add Condition [X = Y] to Editor. The Analyze in Channel submenu also offers the Show Exploited Vulnerability and Show Targeted Asset commands to open detailed views of assets or vulnerabilities, if present in the selected event.

Debug Filter

Evaluate if the selected event passes the filter resource selected from the filter resource popup.

Debug Event Priority

Display information on how event priorities are determined for the selected event. The window lists which conditions match the event. Items under each category: Severity, Relevance, Model Confidence, and Asset Criticality, and the total scores. For each category, certain factors contribute their individual scores. The scores are added to calculate the total. However, if the sum exceeds the upper limit of 10, 10 is displayed fo the category’s total score. Lower limit is 0.

Debug Event Priority is applicable to Threat Level Monitoring, described in Threat Evaluation and also Priority Calculations and Ratings.

Active List

Add the selected event to, or remove it from, an active list. See Adding Events from a Channel to an Active List.

Annotate Event

Open this event in the Annotate Events dialog box, where you can click the Stage field to set a collaboration workflow sequence for this event. When you select a stage you automatically place the event in the corresponding group in the Stages resource tree in the Navigator panel, where you and other analysts can collaborate on its investigation and resolution.

Mark as Reviewed

Set the event's annotation flag to IsReviewed. See Event Annotation Group, specially the Flags label, for a list of event annotation fields.

Event Graph

Graph any logical relationships (that is, source/target IP address connections) that exist among the currently selected events.

Rule Chain Graph

Graph the rule chains behind the currently selected triggered events.

Geographic View

Geographically map the source and destination IP addresses of the selected events.

Integration Commands

Tools

Displays the Tools command menus (also available from the menu, Tools > Local Commands. See Using the Network Tools and Using the Tools Menu.

Export

Export the selected events to an external event-tracking system, such as comma-separated-value (CSV) data in a report or for a spreadsheet, or save it as an HTML or a JPEG file.

Add to Case

Add the selected events to a new case for tracking.

Payload

Keep or discard the payload associated with a selected event. Disabled if the selected event has no associated payload.

Report

Includes two options:

• Event Context Report: Output a report concerning rules and events within a specified time window. See Running an Event Context Report for details.

• Channel Report: Output a report of all events in the channel. See Running a Channel Report for details.

Close

Close the current individual view within the selected view type.

Knowledge Base

If defined, show the Knowledge Base pages associated with the selected events, or associate new pages.

Reference Pages

Vendor Page

If available, show vendor Web page of the event's sensing device.

Help

Open the online Help to this topic.