Triaging Suspicious Entities

Clicking the Threats menu item displays the Threats screen, where the process of triaging Suspicious Entities that have been triggered by one or more Detections begins. The Threats screen is the situational overview that highlights the relevant Suspicious Entities that may be threatening your valuable network, property and resources. When a Suspicious Entity is established, automatically creates a Triage Card to track the initial analysis of the possible threat.

  1. Triage Cards counter– Displays total count of Detections by Severity (Critical, High, Medium).
  2. Logs, Indicators and Detections counter– Displays a total count of Enriched Logs, triggered Indicators and Detections.
  3. Triage Card– A single Detection or a series of Detections attributed to a Host, User or specified log field that may represent an attack or potential attack and referred to as a Suspicious Entity. A Detection related to the health of an element or service are also displayed as Triage Cards and referred to as Health Entities. A Triage Card shows the number of Indicators & Detections triggered for the Suspicious Entity, the date/time of the last Detection triggered, and a summary list of Detection names. The entity Triage Cards are sorted from top to bottom with entities that have the most offending detection severity prioritized at the top of the list.

4. ENTITY TYPE filter– This filters between Suspicious Entities and Health Entities.

5. THREAT TYPE filter – This drop-down menu filters which Suspicious Entity Triage Cards are displayed based on the following criteria:

  • All displays all Triage Cards.
  • Without Case displays all Triage Cards without an associated Security Incident Case.
  • Unassigned displays all Triage Cards with an associated Security Incident Case not yet assigned.
  • Retro Scan looks back to display Indicators and Detections from the data in Elasticsearch, which can occur when a new indicator or detection rule is added to the platform. The retro scan feature can be enabled/disabled per account.

6. RULE TYPE filter – This drop-down menu filters between Forescout-defined and Custom Rules defined by clients.

7. Search bar – This allows you to further filter the displayed Suspicious Entities by any unique information on the card.

8. Details button – Clicking the Details button displays the Details page for a Suspicious Entity that does not have an assigned case. From this page, users can elect to create a case and optionally assign the case to a specific analyst for investigation. For information about case creation and management, see Creating and Managing Security Incident Cases and the Workbench.

Dismissing Detections

Triage Cards can be dismissed individually by clicking the Delete icon.

To dismiss Detections in bulk, use the check boxes to select multiple Triage Cards or the "select all" check box at the top of the interface to automatically select all cards in the list. Clicking the Delete icon dismisses all selected Triage Cards and cases for each dismissed entity are automatically created and closed.

You must choose one of the following reasons for the Detection dismissal:

  • False Positive
  • Benign False Positive
  • Duplicate, Link to Existing Case