Incident Detail in Classic View

The incident priority (color-coded based on incident priority score) and the current status that has been assigned to the incident are shown in the upper portion of the header for immediate visibility.

To change the incident status, click the Status drop-down menu and choose a new status. See Available Statuses for more information.

The incident title and summary are displayed prominently in the header to provide information about which product reported the incident and a timestamp for when it was reported. The AI-generated label is displayed at the end of the summary if the description was generated by AI. To display or hide the full summary, click the View more or View less link.

You can edit the incident title by click the (Edit) icon at the end of the title when you hover over the title. To edit the summary, click Edit below the summary to open the Edit Summary dialog box. Enter your changes in markdown format and click Save when completed. Click Cancel to exit the Edit Summary dialog box. While editing the summary, If you navigate away from the text editor, the summary is automatically saved as a draft for the current browser tab only. The draft content is not available if the same session of Cisco XDR is opened in another browser tab. To restore the short description, return to the content and continue with your edits or click Undo or Use draft to remove or restore the draft content.

Note: The edit options is not available for AI generated incident name or summary.

The View detailed description link is displayed just above the summary in the header. The detailed description provides a high-level description of the incident, including the source of the incident and the reason for promotion. The summary information varies depending on the reporting product. You can view and edit the Detailed description if the description was not generated by AI.

1. Click View detailed description in the header to open the Description dialog box.

Note: The AI-generated label is displayed at the bottom of the Description dialog box and the Edit button is not available if the description was generated by AI.



2. Click Edit to open the editor.



3. Enter your changes in markdown format. You can also use the options available in the formatting toolbar.

   Note: If you navigate away from the text editor while editing, the description is automatically saved as a draft for the current browser tab only. The draft content is not available if the same session of Cisco XDR is opened in another browser tab. To restore the description, return to the text editor and continue with your edits or click Undo or Use draft to remove or restore the draft content.

4. Optionally, click the (Preview code) icon to view the modified description.

5. Click Save to close the editor.

6. Click Close to exit the Description dialog box.

The number of linked incidents is displayed beneath the incident title. Click Linked Incidents to open the Linked Incidents drawer and view the other incidents that are linked to the selected incident.

The Linked Incidents drawer displays the total number and list of incidents that are linked to the selected incident along with the date it was linked. Click the linked incident name to open the incident and view it in a new tab.

To unlink an incident, click the (Ellipsis) icon next to the incident you want to unlink and choose Unlink from the drop-down menu. A message is displayed indicating the Incident was successfully unlinked and removes it from the drawer.

To close the drawer, click the (Close) icon in the upper right corner.

The MITRE tactic tag shows the MITRE ATT&CK^® tactics impacting the incident based on the Financial Risk Score, which indicates the probability of financial impact if the MITRE ATT&CK^® patterns are not mitigated—the higher the score, the higher the probability of impact. If there are two or more tactics impacting the incident, the number of tactics is also displayed in the MITRE tactic tag.

Click the MITRE tactic tag to view the MITRE Tactic popup showing a list of specific MITRE ATT&CK tactics and techniques impacting the incident. The MITRE ATT&CK Coverage Map link opens the MITRE ATT&CK Coverage Map page. For details, see MITRE ATT&CK Coverage Map.

Click the (Expand) icon to view all the techniques for each tactic listed. Click the (New Tab) icon next to the tactic name to view the tactic details on the MITRE ATT&CK Enterprise Tactics page in a new tab and the technique link displays the technique details on the MITRE ATT&CK Enterprise Techniques page in a new tab.

Click View events to view all events related to the incident on the Detections tab in the incident detail. For details, see Detection.

You can assign or unassign users from the Assigned field in the upper right corner of the header. When the incident is assigned, an avatar with the user's initials is displayed and you can hover over the avatar to view the user's full name in a tooltip.

Note: If a user with an Incident Responder or Security Analyst role navigates to the Incident Detail page for an incident that is Unassigned and has a status of New, the incident is automatically assigned to the current user and the status is changed to Open.

For more information on assigning users to an incident, see Assign Incident.

When an incident is selected, a URL is generated in the browser address bar that you can copy and share the incident with others. In addition, if you click a tab on the Incident Detail page, the tab name is appended to the URL.

The attack graph in the upper portion of the Overview tab displays a compacted relationship view of the investigation of events that caused the incident to be promoted. This view provides a linear progression of the attack at a high level.

Note: If the graph has reached its maximum load limit, the graph will not load and a message is displayed. You can continue to access other incident details.

The nodes on the graph represent the devices, entities, and resources that the threat has targeted, as identified by one or more observables (see Graph Icon Descriptions for more information). When targets and observables have the same strong identifier and relationship, they are unified into one node to simplify the view and reduce the noise on the graph. The badge on the node displays the number of objects that have been unified and the disposition icon is displayed on the left side of the node, if applicable. For details, see Color and Icon Key. The (Actions Taken) icon on the right side of the node indicates that remedial actions have been executed by the integrated Endpoint Detection and Response (EDR) source for the device.

The relationship between nodes is shown on the label of the directional arrow that connects to other nodes. When there are multiple nodes that have been unified into one object and share a directional arrow, you can hover over one node to highlight the other nodes that have a relationship to it.

Right-click a node on the graph to open the Pivot menu that enables you to take action on the node. You can perform some actions directly in the Pivot menu or pivot to the integrated product to perform additional actions. If the nodes are grouped, double-click the grouped node to expand it and then right-click a node to open the Pivot menu.

The Assets card displays the total number of unique assets from all of the events related to the selected incident and the top five unique assets with the most events. The number of events where each asset was sighted is also shown. The assets are represented by an icon that allows you to easily distinguish the asset type.

Each asset includes a (Pivot Menu) icon that enables you to take action on it. You can perform some actions directly in the Pivot menu or pivot to the integrated product to perform additional actions.

The Observables card displays the total number of unique observables from all of the events related to the incident. It includes the top five unique observables with the most events, the color-coded disposition of the observable, the event count for each observable, and the observable identifier and type. The observable is represented by a color-coded icon that allows you to easily distinguish the observable type.

Each observable includes a (Pivot Menu) icon that enables you to take action on it. You can perform some actions directly in the Pivot menu or pivot to the integrated product to perform additional actions. For more information, see Pivot Menu.

The Indicators card displays the total number of unique indicators from all events related to the incident. It includes the top five unique indicators (producer) with the most events and the event count for each indicator.

Column Name	Description
First Seen	Date and time of the first detection in an event created by the source. The events are sorted by timestamp and you can choose to sort newest to oldest (ascending) or oldest to newest (descending) using the (Sort) icon in the column heading.
Severity	The threat level given to the event (Critical, High, Medium, Low, None, Unknown, Info). You can sort the events by highest to lowest severity (Descending) or lowest to highest severity (Ascending) using the sort icon in the column heading.
Source	Cisco XDR integration or source that produced the event. Click the Source link to open the event in the originating product. You can sort the sources alphabetically using the sort icon in the column heading.
Indicators	List of indicators the event is related to via a event-of relationship.
Observables	The first three observables that were contained in the event, and dispositions of the observables taken from verdicts. The observables are color-coded and sorted based on the disposition. If more than three observables were seen in the event, the number of additional observables is displayed in the + more link beneath the list. Click the + more link to open the Observables drawer and view all the observables seen in the event. Use the Search bar in the upper portion of the drawer to quickly search the list of observables and use the Disposition or Type drop-down list and check the check boxes next to the disposition or observable type values to narrow the display based on disposition or observable type. If you do not choose a disposition or type, all observables with all dispositions and types are displayed in the list. Click the (Clear) icon to remove your selections. Click the (Pivot Menu) icon next to the observable name to view the disposition, observable type, and verdicts associated with the observable, and perform additional tasks. See the Pivot Menu help topic for more information.
Assets	The assets that were targeted in the event; where the displayed asset values are based on strong identifier types. The assets are color-coded based the asset type. Click the (Pivot Menu) icon next to the observable name to view the disposition, observable type, and verdicts associated with the observable, and perform additional tasks. See the Pivot Menu help topic for more information.
Last Seen	Date and time of the latest detection in an event created by the source. The events are sorted by timestamp and you can choose to sort newest to oldest (ascending) or oldest to newest (descending) using the (Sort) icon in the column heading. This is an optional column that is only available in the Table settings drawer. For details, see Customize Columns.
Name	Name of the event defined by the source. This is an optional column that is only available in the Table settings drawer. For details, see Customize Columns.

You can filter the events by type, source, and severity to narrow the list of results in the table. By default, all the events are displayed.

Filter by Type

Click the Type drop-down list and choose which events you want displayed in the list. When multiple types are selected, the number of selections is displayed on the label. Click the (Clear) icon to remove your selections.

Filter by Source

The Source menu allows you filter through events that were promoted from specific integrations.

Click the Source drop-down menu and check the check boxes next to the integrations that promoted the events. When multiple integrations are selected, the number of selections is displayed on the label. Click the (Clear) icon to remove your selections.

If the event contains 5 or more integrations, a Search bar is visible to enable you to narrow the filter options even further.

Filter by Severity

The Severity menu allows you display events based on the severity level (Critical, High, Medium, Low, None, Unknown, Info).

Click the Severity drop-down menu and choose the severity level of the events and indicators that you want displayed in the list. When multiple severities are selected, the number of selections is displayed on the label. Click the (Clear) icon to remove your selections.

You can reorder the columns in the table and select the columns displayed to customize the table for the data you want to view.

To reorder the table columns, click and drag a column header to the desired position in the table.

To customize the columns, click the (Settings) to open the Display Settings drawer and check the check boxes next to the columns you want displayed in the events table. If custom columns are displayed, click Reset to defaults to reset the table column settings to its default values.

Click Download JSON in the upper right corner of the Detection tab to download all the events in the detections table in JSON format.

When you click an event in the list, the Event drawer opens where you can quickly view the details of the event.