Page Comparison

The Insight Assets tab provides a summary of insights and their details. It includes a summary of all assets associated with an Insight, which gives a brief description of the Insight along with its priority level and detection dates. The Assets tab also displays a priority rating card, showing the priority level of the insight. In the Assets tab, an insight status can be edited. The Share & Export feature allows users to share insights within their organization. The Assets tab also includes options to select and deselect asset records, collapse or expand all asset records, and view a report banner explaining the purpose of the Insight Assets report.

Image Modified

Image: A detailed view of the SOC Insights - Viewing Insight Assets dashboard used for managing SOC insights. The Viewing Insight Assets dashboard is designed to provide a detailed analysis of threats to cybersecurity analysts. It enables them to review and manage the affected assets, analyze the threat's impact, and take necessary actions.

...

Insight ID: Roll over the truncated Insight ID displayed on the page to view the full-length Insight ID number in a tool tip.

Copy Insight: ClickImage RemovedClickthe copy icon to copy the insight to the clipboard. 

Edit insight: Click Image RemovedClick the edit icon to change the status of an insight. nThe Insight Change Status window will appear. In the window, you can change the Insight status from Insight Open to Insight Close or Insight Close to Insight Open by toggling the status switch. Optionally, you can leave a comment in the text field at the time of the status change. Finally, you can read prior comments associated with the Insight. Click Save & Close to complete the Insight status change. Do note that the Save & Close button will not be accessible (it will be grayed out) until such time a status change has been made for the Insight.      
Image Modified
Image: A detail view of the Edit window.

Share & Export Options: Click Share & Export to share a selected Insight within your organization. The Share Insight window will appear, allowing you to choose any or all information associated with an Insight. Raw logs can be downloaded in zip format while the Summary can be downloaded as a PDF by clicking Download. 

Image Modified
Image: A detail view of the Share Insight window.

Image Modified

Select/Unselect: Click Select All to select all Asset records. Alternatively, click Unselect All to deselect all selected Asset records. To select a specific record, place a check in the box associated with it.

Collapse All / Expand All: Click Collapse All to collapse all records on the page. Click Expand All to expand all records on the page.

...

• Asset IP: Click Asset IP to see information about the IP address, including the IP address or addresses associated with the asset and the Date range (first observed detection date and last observed detection date) associated with the IP address. 
• 
  Image: A detail view of the IP addresses window.
  
  
  
  
• User: The individual or entity associated with an asset or device that has been affected or associated with an Insight. It represents the user who is using or responsible for the asset or device. The User information provides insights into the individuals or entities involved in the security DNS events and helps in identifying potential threats and taking appropriate actions.
• Operating System: The operating system and its version that is associated with the events and insights being analyzed. It helps in understanding the specific environment and potential vulnerabilities that may be exploited by threat actors. Unfortunately, the specific OS/Version information is not provided in the available sources.
• First Observation: The date and time the indicator was first observed on the network.
• Last Observation: The date and time oif the last observation of the indicator on the network
• Asset Location: Click the location link to view the locations asscoiated with the asset.
• MAC: The MAC address associated with the asset.
• OS/Version: Provides information about the OS and OS version associated with the asset.
• Indicators: Click View All to see details about the indicator or indicators associated with the asset. The following information can be viewed:
  • INDICATOR: The name of the indicator associated with the asset.
  • ACTION: The type of action assigned to the asset. If the action for the same Insight type is changed multiple times within one hour, then after one hour, only the latest action updated in the database will be applied to all the events that occurred during the past hour.
  • RESEARCH IN DOSSIER: Click the Dossier link to view the Dossier Summary report associated with the Asset. For information on Dossier, see Dossier Threat Indicator Reports. 

Image: A detail view of the Indicators window.

• Threat Type: The category or classification of a threat based on the feeds used to detect it and its threat level. It provides information about the type of threat associated with an insight such as phishing, malware, or other supported categories.
  
  

Sort by: Click Sort by to sort by date. Click the up/down arrows to sort ascending or descending. 

Image Modified
Image: The Sort by options menu.

Search: Enter a search criterion in the Search text box. The Cloud Services Portal will show all records that match the criterion.

...

1. Click to complete one of the following tasks: followed by clicking one of the following options: 
2. Click Export to CSV to download the indicator record as a .csv file.
   
   Image: The Export options menu.
   
   
   
   
3. Click Add Indicator(s) to Custom List.
4. In the  Add to Custom List window you can select what custom list or lists to add the indicator or indicators. You can also remove indicators from a custom list or lists. Click Add to complete the Add to Custom List operation.
   
   Image: A detail view of the Add to Custom List window.
   
   
   
   
5. In the  Add to Custom List window you can select what custom list or lists to add the indicator or indicators. You can also remove indicators from a custom list or lists.
6. Click Add to complete the Add to Custom List operation.

For information on Custom lists, see Managing Custom  Lists.

Expand/Close: Click Image RemovedClick the down-pointng arrow icon to expand the details panel where you can view detailed information associated with the selected Insight. Click Image Removed the up-pointng arrow icon to close the details panel

Filtering: ClickImage RemovedClickthe filter icon to open the filtering panel. In the filtering panel, the following filtering criteria:

...

Image: A detail view of the Creat Filter options window.

Filtering can be performed using one or more filtering criteria. Multiple filters can be used simultaneously when filtering records.

...

You can also do the following on the page: 

• Background Tasks: Click Image RemovedClick the hourglass icon to open the side panel to view a list of all running background tasks. 

• Search: Click Image Removed the search icon in the Search text box, then enter your search criterion. 

• Pagination Controls: At the bottom left, there are controls for navigating through different pages of insights, indicating that there is more data available beyond what is displayed on the current page. Click on the number of insight records to display on the page. The options include, 25, 50, or 100.
• Click <Back to Console of Insights to return to the Open Insights console.