Understanding Incidents

An Incident is simply a flag on an Investigation that enables Expel to document Findings and create Remediation Actions. Anything that is especially urgent will be categorized as a Critical Security Incident.

Findings

A Finding is where our SOC analysts document answers to questions like:

• What is it?

• Where is it?

• When did it get here?

• How did it get here?

You may see text-only findings or more detailed evidence findings.

Remediation Actions

A Remediation Action contains the SOC analyst's recommendation(s) on the best next actions to take to mitigate threats to your environment.

• The analyst will provide this guidance when they do not have sufficient access to your system and/or are not able to perform the task themselves based on the technology.

• You may also choose to enable one or more Auto Remediations to instruct our platform to perform certain SOC recommendations automatically, and to grant Expel with the necessary access to do so.

Suspected Threat Type

The threat type indicates the type of activity that was observed for an Incident.

Type	Meaning
Account compromise	A password was compromised, and login was successful. This status is used when we cannot identify the threat vector/origin for a phishing email, or when the malicious activity is in your inbox or email account.
Business email compromise (BEC)	The activity indicates a compromise of a business email account where the password was compromised, login was successful, and actions were successfully taken on a target. This status is only used in situations where we can definitively confirm the threat vector was a phishing email and/or there was malicious activity observed within the email account.
Credential theft	A password was stolen via credential harvesters, but the login was not successful and no actions were taken on the target (due to being blocked by MFA or conditional access).
Non-targeted	The activity displays non-targeted qualities.
Non-targeted commodity malware	The activity displays non-targeted commodity malware qualities.
Policy violation	The activity indicates risky, user-driven behavior such as cryptocurrency mining or piracy.
Red team	The activity is explicitly confirmed to be associated with red team engagement.
Targeted	The activity displays qualities of being targeted to your environment.
Unknown	The activity is from an unknown threat at the time of promotion. This status is subject to change during an investigation.

Suspected Attack Vector

The attack vector indicates the vector of compromise identified for an Incident (meaning, what allowed the malware or actor into the environment).

Vector	Meaning
Credential theft	The vector of compromise is theft of credentials.
Drive-by download	The vector of compromise is a malicious download that occurred while visiting a malicious or compromised website.
Misconfiguration	The vector of compromise is an improperly secured resource that was left unintentionally exposed.
Phishing	The vector of compromise is phishing activity.
Phishing - attachment	The vector of compromise is specifically a phishing attachment.
Phishing - link	The vector of compromise is specifically a phishing link.
Removable media	The vector of compromise is some type of removable media (like an infected USB drive).
Server-side vulnerability	The vector of compromise is a software infrastructure attack via a server.
Spear phishing	The vector of compromise is a targeted fraudulent email impersonating a trusted source.
Spear phishing - attachment	The vector of compromise is specifically an attachment in a fraudulent email impersonating a trusted source.
Spear phishing - link	The vector of compromise is specifically a link in a fraudulent email impersonating a trusted source.
Strategic web compromise	The vector of compromise is watering hole attack via an infected, trusted website.
Unknown	The vector of compromise is unknown.

Suspected Attack Lifecycle

The attack lifecycle helps contextualize an Incident within the Cyber Kill Chain and MITRE ATT&CK frameworks. See About Detection Strategy for more information about these frameworks.

Stage	Meaning
Actions on targets	The attack occurred during the Cyber Kill Chain's Action on Objectives stage.
Command & control (C2)	The attack occurred during the Cyber Kill Chain's Command & Control stage.
Delivery	The attack occurred during the Cyber Kill Chain's Delivery stage.
Exploitation	The attack occurred during the Cyber Kill Chain's Exploitation stage.
Initial recon	The attack occurred during the Cyber Kill Chain's Reconnaissance stage.
Installation	The attack occurred during the Cyber Kill Chain's Installation stage.
Lateral movement	The attack indicates Lateral Movement, per the MITRE ATT&CK framework.
Unknown	The stage of the attack is unknown.