Case Details view

Clicking a Case or Case ID displays the Case Details screen. The Case Details Screen is like the Suspicious Entity Details screen with additional information and statistics related to the ongoing investigation of the Security Incident Case.

  1. DESCRIPTION – This field is meant to capture the initial description of the Security Incident.
  2. INCIDENT ANALYSIS – This field is meant to capture the various insights and determinations Security Analysts have as they work through the investigation to identify the full nature and scope of the Security Incident.
  3. RECOMMENDATIONS – This field is meant to capture the recommendations that the SOC develops to resolve the Security Incident.

  4. Case Context and Statistics – This area provides some additional, optional, labels that can be added to further contextualize the Security Incident beyond what’s available in the initial Create Case window as follows:

    • Assigned to – Specifies the user to which the case will be assigned.
    • Requested By – Specifies the user who requested the case, which can be different from the user who creates the case.
    • Status – Specifies the Status of the Case for the purposes of change notification. When a Security Incident Case is first created, the default status is “Detection and Analysis”.
    • Detection Severity – Specifies the severity as either Critical, High, Medium or Low.
    • Impact – The Impact value measures the business criticality of a Security Incident, often equal to the extent to which it affects the availability of the Customer’s environment.
    • Incident Category – Displays the Security Incident Category selected when the case was created, which can be changed to a new category here.
    • Cyber Kill Chain Phase – Optionally specifies the phase of the Cyber Kill Chain to which the case relates.
    4.a) MITRE ATT&CK – Provides additional insight within the context of the MITRE ATT&CK framework. Users can remove and add MITRE techniques, and clicking on a technique links the user to the official MITRE ATT&CK website description for the technique.

  5. Resolve button – Clicking this button opens the Resolve Case window.
  6. Linked Cases – Lists the related cases. Click the + button to link to additional cases.
  7. Detection Timeline – See Performing Detection Analysis with the Detection Timeline for more information.
  8. Detection Details – Lists the detection rules that triggered notification of a Suspicious Entity.

  9. Comments, External Case Management, and Attachments – Primarily for use by Forescout's 24/7 SOC in delivery of the Forescout SOCaaS service, this section of the screen provides a place for linking cases together and to a customer’s internal incident tracking system. Both Operators and Administrators can also add and delete attachments related to the case.

  10. Deleting Attachments – Click the Delete icon to delete an attachment from a Case. Operators can only delete attachments they have added to a case, and Administrators can delete any attachment from any Case. Forescout Cloud will retain a record of attachment deletions from Cases.