View an Incident

When you view an Incident, you will have access to all of the information our SOC analysts have.

The information we gather in Workbench is retained for 15 months. After 15 months, it is permanently deleted.

View All Incidents

The Incidents page shows you all of the Investigations for your environment. You can find it by going to Activity > Incidents.

When you first open this page, you will see all Investigations sorted by the most recent.

Find a Specific Incident

To find an Incident:

• You can search for its number using the Search field (every Incident has a number associated with it).

• You can use the filter options at the top of the page to filter by status, threat type, assignment, lead alert, etc.

Select the blue name of the Incident to open it. This is where you can view Findings, Investigative Actions, Remediation Actions, a timeline, any custom rules, etc.