Investigate Top Alerts

Anomalies that are found as incoming events are compared to the baseline and compiled into hourly alerts. Relatively strong deviations from the baseline, together with a unique composition of anomalies, are more likely to get a higher alert score.

You can quickly view the most critical alerts in your environment, and start investigating them from either the OVERVIEW tab or the ALERTS tab. The following figure is an example of top alerts in the OVERVIEW tab. The alerts are listed in order of severity and the number of users who generate the alerts.

1241_overview-tab_0424.png

To investigate an alert on this page, click an alert in the Top Alerts section.

The following figure shows details about the event that caused the alert, and the time frame in which it occurred.

1241_alert-graph-example_0424.png

From the Alerts Severity panel at the bottom of the Overview tab, you can click on a bar in the graph to review top alerts in the ALERTS tab. The following figure shows the top alerts listed in the Alerts tab.

1241_top-alerts-alerts-tab_0424.png

Investigating alerts is particularly useful when you want to focus on a timeframe in which you believe your systems were compromised. You can view forensic information based on a timeframe and gather detailed information about events that occurred during that time in the Alerts tab.

122_top-alerts-alerts-tab_123.png

Begin an Investigation of Critical Alerts

You can begin your investigation of critical alerts in the following ways:

netwitness_alert-flow.png

  1. On the Overview tab, look at the ALL ALERTS.
    alerts-severity123.png
    Is there an even distribution of alerts or are there a few days when there was a noticeable spike? A spike could indicate something suspicious like malware. Make a note of those days so you can inspect the alerts (the bar from the chart links directly to the alerts for that specific day).
  2. In the Alerts tab, you can view the indicator count:
    1241_alerts-no-of-indicators_0424.png
    To identify users with the highest number of alerts, more indicators help illustrate more insights and provide a more rigid timeline that you can follow.

  3. Expand the top alerts in the list:

    • Look for alerts that have varied data sources. These show a broader pattern of behavior.
    • Look for a variety of different indicators.
    • Look for indicators with high numeric values, specifically for high values that are not indicative of a manual activity (for example, a user accessed 8,000 files).
  4. Look for unique Windows event types that users do not typically change as these can indicate suspicious administrative activity.
  5. Filter by indicators.
    1241_IndicatorList_0424.png
    The list shows the number of alerts raised that contain each indicator.
    • Look for the top volume indicators; filter by an indicator and review by user to find users who experienced the highest number of these indicators.
    • In general, you can ignore time-based alerts (for example, Abnormal Logon Time) as these are very common. However, they provide good context when combined with higher interest indicators.
  6. Drill into more detail:
    • Leverage alert names to begin establishing a threat narrative. Use the strongest contributing indicator that usually determines the alert’s name to begin explaining why this user is flagged.
    • Use the timeline to layout the activities found and try to understand the observed behaviors.
    • Follow up by reviewing each indicator and demonstrating the supporting information, in the form of graphs and events, that can help you verify an incident. Suggest possible next stages of investigation using external resources (for example, SIEM, network forensics, and directly reaching out to the user, or a managing director).
    • Conclude the investigation by prompting for feedback and leaving a comment.
  7. Take action to address threats determined by the investigation of alerts. For more information, see Take Action on High-Risk User or Network Entity .

The following topics explain various ways to investigate alerts.