🌙
 

Subscribe to the Taegis™ XDR Documentation RSS Feed at .

Learn more about RSS readers or RSS browser extensions.

Alert Triage Dashboard

dashboards alerts investigations widgets


Use the Alert Triage Dashboard to view activity in your environment and quickly assess possible ongoing threats or notifications of suspected deleterious actions.

Get to the Alert Triage Dashboard

  1. From the Secureworks® Taegis™ XDR side menu bar, select Dashboards > Alert Triage.
  2. The Dashboard displays.

Alert Triage Dashboard

Alert Triage Dashboard

Edit Dashboard Settings

Severity

Filter all Alert Triage Dashboard widgets by alert severity using the severity filter at the top of the dashboard. All are selected by default; deselect those you wish to exclude.

Dashboard Severity Filter

Dashboard Severity Filter

Date/Time

The Alert Triage Dashboard uses master date/time settings, which change the time period of all widgets at the same time.

Change the time period using the drop-down date/time picker at the top right of the dashboard. The default time period is 72 Hours, but choosing a custom time period overwrites it. The most recent time period selected becomes the new default.

Dashboard Date/Time Picker

Dashboard Date/Time Picker

Custom Alerts

To include alerts that match your custom alert rules, open Include Options at the top right and select Custom Alerts.

Dashboard Include Options

Dashboard Include Options

Refresh Dashboard

To refresh the data in all widgets of the Alert Triage Dashboard, select the Refresh Dashboard icon at the top right of the dashboard.

Refresh Dashboard

Refresh Dashboard

Widgets

The Alert Triage Dashboard includes the following widgets:

Recent Alerts

The Recent Alerts widget displays all alerts that are open and not related to an investigation. The title, create date and time, hostname, and MITRE ATT&CK framework category of each alert are displayed.

Tip

Recent Alerts gives you a method to focus and triage new alerts at a glance.

Recent Alerts Widget

Recent Alerts Widget

Alerts by Detector

The Alerts By Detector widget gives you a quick overview of incoming alerts sorted by detector. This enables you to evaluate alerts from the perspective of alerts inflowing from Secureworks Taegis XDR and third party sources.

Tip

The Alerts By Detector widget gives you an easy-to-understand view of the various alerts coming in from both Secureworks® Taegis™ XDR Detectors and any third party detection sources you have configured. It allows you to see alert activity by detector to help you be aware of activity trends.

Alerts by Detector Widget

Alerts by Detector Widget

Broken Bar on Detector

Broken Bar on Detector

Recent Investigations

The Recent Investigations widget lists the five most recently active in-progress investigations. In addition to the investigation name, the widget displays the priority, severity, type, assignee, and when each investigation was last updated.

Tip

The Recent Investigations widget gives you a place to access your ongoing investigations, so you can get back to where you were working, hop over to an active investigation, or view all investigations.

Recent Investigations Widget

Recent Investigations Widget

Top Concerns

The Top Concerns widget displays a list of users, domains, hosts, or titles with the most alerts. Select one of these options from the drop-down to view matching results. Each list is sorted by the number of related alerts.

Tip

The Top Concerns widget enables you to review alert data as it pertains to the related entity (user, domain, host, or title watchlist). Grouping alerts by these related entities enables you to focus on alerts currently impacting a particular target.

Top Concerns Widget

Top Concerns Widget

Threat Intelligence Reports

The Threat Intelligence Reports widget provides a list of the latest CTU™ Threat Intelligence Reports, with a search function that allows you to filter for specific topics or items.

Tip

The Threat Intelligence Reports widget allows you to stay up to date on the Threat Landscape as observed by Secureworks Security Researchers.

Threat Intelligence Reports Widget

Threat Intelligence Reports Widget

Threat Intelligence Reports Pivot Search

Threat Intelligence Reports Pivot Search

Export Options

Export Dashboard to PNG

To export the entire dashboard to a PNG image file, select Actions from the top right of the dashboard and choose Download as PNG. The file automatically downloads.

Export Dashboard to PNG

Export Dashboard to PNG

Export Widgets to PNG

To export an individual widget to a PNG image file, select the vertical ellipsis from the top right of the desired widget and choose Download as PNG. The file automatically downloads.

Export Widget to PNG

Export Widget to PNG

Export Data

For users opted in to Preview mode, you can export data from the dashboard or individual widgets to a CSV or JSON file:

Export Dashboard Data

Export Dashboard Data

Export Widget Data

Export Widget Data

 

On this page: