Performing detection analysis with the Detection Timeline

The Detection Timeline eliminates manual correlation and lookups required to analyze a Suspicious Entity. On the Suspicious Entity Details Screen, clicking a Detection ID will highlight the event on the Detection Timeline and display detailed information about the one or more Indicators that comprise it.

The Detection Timeline allows Security Analysts to:

  • View the apparent target address(es) of the Indicator to determine the reputation of the target view specific Name and Description for the Indicator and Detection that was triggered
  • View the enriched Log source that was used to trigger the Indicator, or the analytic model
  • View the Indicator(s) that are attributed to the Detection being triggered
  • View the Date & Time when all Indicators and Detections were triggered, especially first and last
  • Query against IP attribution data to confirm that the identified host was leased the source IP address that was in the log that triggered the Indicator
  • Query against multiple enriched, mapped, and lookup data sources.
  • Filter the displayed information between All, Notable Fields, Indicators Only and Logs Only.

AI-generated Detection Summary

The AI-powered Detection Summary is triggered by clicking the AI button on the Suspicious Entity Details view. The summary helps improve SOC analyst productivity when drafting an incident report.

The AI Detection Summary offers factual data, description and insights broken into the following categories:

  • Threat Summary: Provides a narrative description of the chronology of events, accurate to the second, and the involved assets of the detection.
  • Device and Location Details: Provides relevant details about the specific device affected by the detection, including its logical location, Risk Score (requires Forescout Cyber Risk Exposure), Device Criticality, OS, Host Category, Function, Exposed Services, active CVEs and device Vendor.
  • Device Risk Exposure: For those who have Forescout Risk and Exposure Management, this category provides a detailed justification of the asset's risk score, including description of exposed services and outstanding CVEs.
  • Device Mitigation: Provides the titles and CVSS scores of all CVEs registered against the asset, which can be referenced by analysts to implement the necessary updates to improve the asset's security posture.

This feature can be toggled on or off in Account Settings.

Suspicious Entity linked to Asset

For   customers that have also purchased  , if a Detection links to an Asset present in the Asset inventory then the View Asset button will appear next to it on the Suspicious Entity Details view. Click View Asset to load the Expanded Asset View for that Asset to examine its details.