The Suspicious Entity details screen

The Suspicious Entity Details screen brings correlated log sources, attribution and enrichment insights together in one place. This gives Security Analysts the insight they need to quickly analyze and understand the context of a potential threat and determine whether it warrants the creation of a Case and escalation to a customer SOC or Forescout’s SOC.

  1. Detection Timeline – Shows a timeline of when Detections (which include one or more Indicators) were triggered so the Security Analyst can quickly determine the exact sequence of events. A total count of Indicators and Detections, as well as the entity’s severity, is displayed above the timeline. Detections are indicated by the points that appear along the timeline. Clicking a Detection on the Detection Timeline displays detailed information about it (for more information see Performing Detection Analysis with the Detection Timeline).
  2. New Detections for Entity– Shows the individual Detections for the Suspicious Entity with timestamps. Clicking a Detection ID displays detailed information about and highlights the detection on the timeline (or more information, see Performing Detection Analysis with the Detection Timeline).
  3. Key Information– Displays contextual information about the attack target, when relevant.
  4. Top User Authentications – Displays users who have logged into the host who may have been impacted by the potentially malicious event.
  5. Show Filter - Filters the information presented under the "New Detections for Entity" section of the view, as follows between "All", "Notable Fields", "Indicators Only" and "Logs Only".
    • All – Displays all information related to the Suspicious Entity.
    • Notable Fields – Forescout's Threat Detection Engine looks at specific fields within logs to trigger Indicators. Selecting this setting highlights Indicator fields to help with analysis.
    • Indicators Only – Displays only indicator information for the Suspicious Entity.
    • Logs Only – Displays only log information related to the Suspicious Entity.
  6. Create button – Clicking the Create button opens the Create Case window. An Analyst will typically create a Case when an initial investigation cannot confirm that the event is benign. For more information, see Creating and Managing Security Incident Cases and Workbench.