SOCaaP

Incident Category Management

Incident categories let you classify events based on their impact on the endpoint or network.

You can assign colors to identify each category.

There are predefined, default categories for managing essential incidents.

You can add and edit categories as required.

The default incident categories are:

Authentication Anomalies

Anomalies in privileged user account activities

Anomalies specific to endpoint and backend

Check for known APS

Correlated

DNS Request Anomalies

Malware Activity

Malware

Manual

Scheduled Query

Unusual Network Traffic

Unpatched for Vulnerable Systems or applications

Web traffic anomalies

Incident Category Management List - Table of Column Descriptions
Column Header	Description
Category Name	Label of the category.
Auto Assigned User	The user who is assigned to deal with incidents which belong to this category.
Manual Assigned Users	Users assigned when the category was created or edited.
Color	Represents the category type.

Note:

Users take action on incidents.

When an incident is created, it is automatically assigned to a user who is present in the 'Auto Assigned Users' list.

You can reassign an incident to a user who is on the 'Manually Assigned Users' list. If the list is empty, you cannot assign the incident manually to a user.

To add users to the existing list available see 'Managing Users'.

Add a Incident Category

To monitor and manage the types of incidents detected based on the correlation rules

Once a category is added, the incidents will be grouped to the specified category based on the correlation results

Based on the severity/priority the incident category is either auto-assigned or manually assigned to users for performing required action.

To add a new category

Click the 'Add' button on the bottom right of the interface

The 'Add Category' dialog will open.

Enter a name to identify the detected incident type

Select a color code from the 'Color' drop down, to indicate the category

Select the user to whom you want the incident alerts to be sent

You can choose to assign users automatically or manually by selecting the options 'Auto-Assigned User' or 'Manual Assigned Users' columns against the user