🌙
 

Subscribe to the Taegis™ XDR Documentation RSS Feed at .

Learn more about RSS readers or RSS browser extensions.

Resolve Alerts (Change Alert Status)

alerts


After you have reviewed alerts in Secureworks® Taegis™ XDR, resolve them by setting one of the following statuses:

Tip

Once alerts are resolved they no longer appear on the Alert Triage Dashboard or on the Alerts page as they are now considered triaged.

You can also let us know whether the alert is valuable to your organization by giving it a thumbs up or thumbs down: Thumbs Up or Down

Note

Alert ratings help the system learn what types of alerts and information within those alerts are valuable to your organization. As the system gradually learns, you can expect to see this influence the severity, confidence, and suggested prioritization of similar activity.

There are a few ways to apply one of these labels:

From an Individual Alert

When viewing an individual alert details page, or previewing it in a side panel:

  1. Under the Manage section, select Status.
  2. Choose a status.
  3. (Optional) Provide further details about why this status applies.
  4. Select Add.

Resolve Alert by Changing the Status

Resolve Alert by Changing the Status

From a Table of Alerts

When viewing a table of alerts, such as on the Alerts page or in search results:

  1. Select one or more alerts using the checkmark.
  2. Select Actions > Resolve Alerts.
  3. Choose a status and provide further (optional) details about why this status applies.
  4. Select OK.

Resolving Alerts in Search Results

Resolving Alerts in Search Results

From an Investigation

When an investigation is closed, its related alerts and genesis alerts will be labeled automatically according to the close code. See Close an Investigation for steps and to see how close codes map to alert labels.

What is the Difference between a False Positive and True Positive?

To understand how benign events are classified, what decisions you may have to make, and what comes next, it helps to think about security events and alerts like a building’s fire alarm.

POSITIVE NEGATIVE
TRUE The building catches fire, and the alarm sounds. The building is not on fire, and the alarm does not sound.
FALSE There is no fire, but someone pulls the fire alarm. The building is on fire, but the alarm does not sound.

False Positives and True Negatives

This analogy helps explain how to label alerts in Secureworks® Taegis™ XDR:

Labels Fire Alarm Analogy Alert Examples
False Positive A prankster pulls the fire alarm even though there is no danger. - DGA detector classifying a domain malicious when it is not.

- Anti-virus classifying file as malicious when it is not.
True Positive: Benign The fire department tests the alarms, or someone smokes in the bathroom. There is no danger, even though the alarm is triggered. - Administrative commands that are also used by threat actors

- Legitimate applications registering persistence

- Internal penetration test
True Positive: Malicious A fire starts in the kitchen and the alarm sounds. The fire will be put out. - Malware Infection

- Successful Exploit

- Account Compromise
Not Actionable The fire alarm is malfunctioning in the neighbor’s house. - Malware infection identified on guest wireless network

- Activity identified on unowned assets

Secureworks® Taegis™ XDR Alert Examples

 

On this page: