> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-reference/investigations-and-incidents/understanding-incidents.md). # Understanding Incidents An **Incident** is simply a flag on an [Investigation](/workbench-reference/investigations-and-incidents/understanding-investigations.md) that enables Expel to document [Findings](#findings) and create [Remediation Actions](#remediation-actions). Anything that is especially urgent will be categorized as a **Critical Security Incident**. ## Findings A **Finding** is where our SOC analysts document answers to questions like: * What is it? * Where is it? * When did it get here? * How did it get here? You may see text-only findings or more detailed evidence findings. ## Remediation Actions A **Remediation Action** contains the SOC analyst's recommendation(s) on the best next actions to take to mitigate threats to your environment. * The analyst will provide this guidance when they do not have sufficient access to your system and/or are not able to perform the task themselves based on the technology. * You may also choose to enable one or more [Auto Remediations](/workbench-setup/auto-remediations/about-auto-remediations.md) to instruct our platform to perform certain SOC recommendations automatically, and to grant Expel with the necessary access to do so. ## Suspected Threat Type The threat type indicates the type of activity that was observed for an Incident.

Type	Meaning
Account compromise	A password was compromised, and login was successful. This status is used when we cannot identify the threat vector/origin for a phishing email, or when the malicious activity is in your inbox or email account.
Business email compromise (BEC)	The activity indicates a compromise of a business email account where the password was compromised, login was successful, and actions were successfully taken on a target. This status is only used in situations where we can definitively confirm the threat vector was a phishing email and/or there was malicious activity observed within the email account.
Credential theft	A password was stolen via credential harvesters, but the login was not successful and no actions were taken on the target (due to being blocked by MFA or conditional access).
Non-targeted	The activity displays non-targeted qualities.
Non-targeted commodity malware	The activity displays non-targeted commodity malware qualities.
Policy violation	The activity indicates risky, user-driven behavior such as cryptocurrency mining or piracy.
Red team	The activity is explicitly confirmed to be associated with red team engagement.
Targeted	The activity displays qualities of being targeted to your environment.
Unknown	The activity is from an unknown threat at the time of promotion. This status is subject to change during an investigation.

## Suspected Attack Vector The attack vector indicates the vector of compromise identified for an Incident (meaning, what allowed the malware or actor into the environment).

Vector	Meaning
Credential theft	The vector of compromise is theft of credentials.
Drive-by download	The vector of compromise is a malicious download that occurred while visiting a malicious or compromised website.
Misconfiguration	The vector of compromise is an improperly secured resource that was left unintentionally exposed.
Phishing	The vector of compromise is phishing activity.
Phishing - attachment	The vector of compromise is specifically a phishing attachment.
Phishing - link	The vector of compromise is specifically a phishing link.
Removable media	The vector of compromise is some type of removable media (like an infected USB drive).
Server-side vulnerability	The vector of compromise is a software infrastructure attack via a server.
Spear phishing	The vector of compromise is a targeted fraudulent email impersonating a trusted source.
Spear phishing - attachment	The vector of compromise is specifically an attachment in a fraudulent email impersonating a trusted source.
Spear phishing - link	The vector of compromise is specifically a link in a fraudulent email impersonating a trusted source.
Strategic web compromise	The vector of compromise is watering hole attack via an infected, trusted website.
Unknown	The vector of compromise is unknown.

## Suspected Attack Lifecycle The attack lifecycle helps contextualize an Incident within the Cyber Kill Chain and MITRE ATT\&CK frameworks. See [About Detection Strategy](/workbench-reference/detections/about-detection-strategy.md) for more information about these frameworks.

Stage	Meaning
Actions on targets	The attack occurred during the Cyber Kill Chain's Action on Objectives stage.
Command & control (C2)	The attack occurred during the Cyber Kill Chain's Command & Control stage.
Delivery	The attack occurred during the Cyber Kill Chain's Delivery stage.
Exploitation	The attack occurred during the Cyber Kill Chain's Exploitation stage.
Initial recon	The attack occurred during the Cyber Kill Chain's Reconnaissance stage.
Installation	The attack occurred during the Cyber Kill Chain's Installation stage.
Lateral movement	The attack indicates Lateral Movement, per the MITRE ATT&CK framework.
Unknown	The stage of the attack is unknown.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/workbench-reference/investigations-and-incidents/understanding-incidents.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.