The SOC Insight Report Events tab provides a comprehensive view of all security DNS events associated with an insight. It displays important information such as the threat level, threat confidence, date and time of detection, class, query, query type, user, device IP, threat family, policy, action, and source. Additionally, you can customize the table layout by selecting which data columns to display. The Events tab also allows you to search for specific events, filter events based on criteria such as threat level and query and export all insight events records in .csv format.

Image: A detailed view of the SOC Insights - Viewing Insight Events dashboard used for managing SOC insights. The Viewing Insight Events dashboard is designed to give cybersecurity professionals detailed and actionable insights on DNS events, allowing them to view, sort, and export event data for further analysis and action.

Dashboard

Insight Summary: The Insight Summary includes a brief description of the Insight including the type of threat associated with the insight. 

Priority Notification: The priority rating card displays the following information about the Insight:

• Priority: The Insight's priority level (High, Medium, Low, or Info).
• Date and time: The Insight's date and time of first detection and for its most recent detection. All times are adjusted to the local time zone. 
  
  

Insight ID: Roll over the truncated Insight ID displayed on the page to view the full-length Insight ID number in a tool tip.

Copy Insight: Clickto copy the insight to the clipboard. 

Edit insight: Click to change the status of an insight. nThe Insight Change Status window will appear. In the window, you can change the Insight status from Insight Open to Insight Close or Insight Close to Insight Open by toggling the status switch. Optionally, you can leave a comment in the text field at the time of the status change. Finally, you can read prior comments associated with the Insight. Click Save & Close to complete the Insight status change. Do note that the Save & Close button will not be accessible (it will be grayed out) until such time a status change has been made for the Insight.      

Image: The Edit Insight window. 

Share & Export Options: Click Share & Export to share a selected Insight within your organization. The Share Insight window will appear, allowing you to choose any or all information associated with an Insight. Raw logs can be downloaded in zip format while the Summary can be downloaded as a PDF by clicking Download. 

Image: The Share Insight window. 

Export: Click Export to export all insight events records in .csv format. 

Events Table: The Events table displays all data associated with an event. The default table layout includes the following data columns. 

• Threat Level: The level of certainty or trustworthiness assigned to a threat or security event. It is a measure of how confident the system is in the accuracy and reliability of the detected threat. By assigning a Threat Confidence score, Insightful Reporting can provide insights into the credibility and severity of potential threats, helping customers prioritize and take appropriate actions to mitigate them.
• Threat Confidence: The level of certainty or trustworthiness assigned to a threat or security event. It is a measure of how confident the system is in the accuracy and reliability of the detected threat. By assigning a Threat Confidence score, Insightful Reporting can provide insights into the credibility and severity of potential threats, helping customers prioritize and take appropriate actions to mitigate them.
• Detected: The timestamp of the event.
• Class: The classification of threats or attacks detected on a network. It helps categorize and identify the nature of the threat or attack. The Class field provides information about the type of threat or attack, such as TI-MAJTHREAT for major attacks.
• Query: A request for specific information or data from the system. It is a way for users to retrieve and analyze data related to threat actors and their activities on their networks. By formulating queries, users can identify patterns of malicious activity, monitor for targeted attacks, and detect potential threats related to malware and data exfiltration. Insightful Reporting provides insights into these queries by correlating data from multiple sources such as remote domains, unique WHOIS data, IP addresses, domain registrars, and malware families.
• Query Type: The type of DNS query made by a device on the network. It provides information about the specific type of DNS request, such as A (address) record, AAAA (IPv6 address) record, CNAME (canonical name) record, MX (mail exchange) record, etc. Query Type helps in analyzing and understanding the nature of the DNS traffic on the network and can be used to identify potential threats or suspicious activities.
• User: The individual or entity associated with an asset or device that has been affected or associated with an Insight. It represents the user who is using or responsible for the asset or device. The User information provides insights into the individuals or entities involved in the security DNS events and helps in identifying potential threats and taking appropriate actions.
• Device IP: The IP address associated with a protected asset or device that has been affected or associated with an Insight. It provides information about the IP address or addresses associated with the asset and the date range of the first observed detection and the most recent observed detection on the network.
• Threat Family: A group or category of threats that share similar characteristics or attributes. It helps in organizing and classifying threats based on their commonalities, such as the type of attack, the techniques used, or the target of the attack. By identifying the threat family, security administrators and analysts can better understand the nature of the threat and take appropriate actions to mitigate it.
• Policy: A set of rules and guidelines that determine how the system detects and handles potential threats. It includes actions such as blocking known and unknown malicious domains, monitoring for malware and data exfiltration, and identifying common application patterns. The policy helps in identifying targeted attacks and provides recommended actions to mitigate the threats.
• Action: The action associated with the domain. This is Blocked or Not Blocked.
• Source: The origin or originator of the threat or malicious activity detected on a network. It could be an individual, a group, or an organization that is responsible for the targeted attack or compromise. the given knowledge base is identified by correlating multiple communications with the same origin, such as IP addresses, unique WHOIS data, domain registrars, malware families, and more.
  
  

The following optional data columns can be added to the default layout. 

Image: The Column Selection panel. 

Search: Enter a search criterion in the Search text box. The Cloud Services Portal will show all records that match the criterion.

Refresh | Show:

• Click  to refresh the page. 
• Click Show to see all events for a specific time period. Select Show All, Last 24 hours, Last 7 days, or Last 30 days.

Image: The Show option list. 

Filtering: Clickto open the filtering panel. In the filtering panel, the following filtering criteria:

• Threat Level: The level of certainty or trustworthiness assigned to a threat or security event. It is a measure of how confident the system is in the accuracy and reliability of the detected threat. By assigning a Threat Confidence score, Insightful Reporting can provide insights into the credibility and severity of potential threats, helping customers prioritize and take appropriate actions to mitigate them.
• Threat Confidence: The level of certainty or trustworthiness assigned to a threat or security event. It is a measure of how confident the system is in the accuracy and reliability of the detected threat. By assigning a Threat Confidence score, Insightful Reporting can provide insights into the credibility and severity of potential threats, helping customers prioritize and take appropriate actions to mitigate them.
• Query: Query is the domain for the particular event.
• Query Type: The type of DNS query made by a device on the network. It provides information about the specific type of DNS request, such as A (address) record, AAAA (IPv6 address) record, CNAME (canonical name) record, MX (mail exchange) record, etc. Query Type helps in analyzing and understanding the nature of the DNS traffic on the network and can be used to identify potential threats or suspicious activities.
• Device IP: The IP address associated with a protected asset or device that has been affected or associated with an Insight. It provides information about the IP address or addresses associated with the asset and the date range of the first observed detection and the most recent observed detection on the network.
• Source: The origin or originator of the threat or malicious activity detected on a network. It could be an individual, a group, or an organization that is responsible for the targeted attack or compromise. the given knowledge base is identified by correlating multiple communications with the same origin, such as IP addresses, unique WHOIS data, domain registrars, malware families, and more.
• Indicator: A DNS detection and response (DDR) that represents a domain or IP address seen in the resolution chain of a query from a device. It provides valuable information about the associated asset IP, user, and operating system. The Indicator Definition helps users understand the meaning and significance of the indicators displayed in the Insight Reporting interface. (Click the link in the indicator column associated with an indicator to view the Dossier Summary report for the indicator. Click the link in the indicator column associated with an indicator to view the Dossier Summary report for the indicator.
• Detected: The timestamp of the event indicating the date and time of detection.

Image: The Filtering panel. 

Filtering can be performed using one or more filtering criteria. Multiple filters can be used simultaneously when filtering records.

You can also do the following on the page: 

• Background Tasks: Click  to open the side panel to view a list of all running background tasks. 

• Search: Click in the Search text box, then enter your search criterion. 

• Pagination Controls: At the bottom left, there are controls for navigating through different pages of insights, indicating that there is more data available beyond what is displayed on the current page. Click on the number of insight records to display on the page. The options include, 25, 50, or 100.
• Click <Back to Console of Insights to return to the Open Insights console.