Prismara Endpoint SecurityHow-to guide
Investigate incidents
Prismara Endpoint Security groups related alerts into a single incident, so you can see everything that happened in one attack together rather than as separate alerts. This article shows you how to find an incident, understand it and close it.
Before you begin
Section titled “Before you begin”- You need the Endpoint Security analyst or Endpoint Security administrator role in Prismara.
- If your organisation uses Prismara SOC, SovSec analysts receive the same incidents automatically. Agree with them who takes the lead, so work isn’t duplicated.
Open the incident queue
Section titled “Open the incident queue”-
Sign in to the Endpoint Security console at
https://endpoint.prismara.eu. -
Select Incidents. The queue shows open incidents, highest severity first.
-
Use the filters to narrow the list, for example by Severity, Status, Assigned to or Device group.
Screenshot pendingIncidents queue with demo incidents of High, Medium and Low severity, filter bar at the top and the Severity and Status columns visible
Severity levels
Section titled “Severity levels”| Severity | What it means |
|---|---|
| High | Activity that is very likely malicious and may still be in progress. Look at it now. |
| Medium | Suspicious activity that needs investigating soon. |
| Low | Activity worth reviewing, often blocked already or low impact. |
| Informational | Recorded for context. No action is usually needed. |
Review an incident
Section titled “Review an incident”-
Select an incident to open it.
-
Read the Summary at the top. It shows what was detected, the severity, and whether the threat was blocked automatically.
-
Select Timeline to see events in the order they happened, such as a file being downloaded, a process starting or a network connection being made.
Screenshot pendingIncident page on the Timeline tab showing a demo sequence of events on CONTOSO-LT01, with timestamps in 24-hour format -
Select Affected devices to see every device involved. Select a device name to see its details, including the signed-in user and the sensor status.
-
Select Evidence to see the files, processes and addresses linked to the incident.
Assign the incident
Section titled “Assign the incident”-
On the incident page, select Assign.
-
Choose a person or team, and select Save.
-
Set Status to In progress so others can see that someone is working on it.
If you need to contain the threat, see Respond to threats.
Resolve the incident
Section titled “Resolve the incident”-
When the investigation is complete, select Resolve.
-
Choose a Classification, such as True positive, Benign or False positive.
-
Add a comment explaining what you found and any action you took, then select Resolve.
Screenshot pendingResolve incident panel with Classification set to True positive and a short demo comment