The ThreatLocker Detect Incident Center | ThreatLocker Help Center

Incident Center

The Incident Center is the streamlined way to investigate alerts in your organization. With the addition of the Incident Center, you can combine related alerts from across your organization into a single case, keeping all information in one place for you to review. To navigate to the Incident Center, simply select any available alert on your ThreatLocker Detect Alert Center.

The Incident Center can also be accessed from the ‘Computer Details’ page. To access this, hover over the ‘Assets’ tab on the left-hand side of the ThreatLocker Portal. Then, select the ‘Computers’ button from the pop-out menu.

Now on the ‘Computers’ page, select the name of the computer you are investigating to open the ‘Computer Details’ sidebar. Once here, navigate to the top of the sidebar. If the selected asset has an existing case, a button labeled "View Case" will appear in this area.

If the asset does not have an existing case, you can create a new one by selecting the button labeled "+ New Case".

Selecting either of these buttons will automatically open the Incident Center for the asset of your choosing.

Case Name

In the top left corner of your case is the ‘Case Name’ section. Here, you can view the name of your case, view assets associated with the case, and assign analysts to it.

Case Name – This field contains the name of your case. ThreatLocker will automatically assign a name to your case when an alert is generated, and the object is not currently in a case.

Edit Case Name – Selecting this button lets you change the case name. Once this button is selected, the field becomes accessible, allowing a new name to be entered. Once you have entered the desired case name, you can select the ‘check’ button or select the ‘X’ button if you would like to cancel editing your case name.

This field provides users with the name of the organization that devices in the case belong to. Selecting the organization name will open the ‘Edit Organization Settings’ sidebar. To the left of the organization name is a button labeled ‘Copy Case Link’ that lets you easily add the case link to your clipboard.

Objects – This section lists all objects associated with the case. Multiple objects can appear here, and both Endpoint and Cloud Detect objects can be added to the same case. An object that has had an action taken on it in the case cannot be removed from it, but if the object has an ‘X’ to the right of the object name, it can be.

Additionally, if there are multiple objects in a case, you can select the object name to filter out all case activity EXCEPT for activity pertaining to the selected object. By selecting the object name again, the page will revert to providing information for all objects in the case.

Assigned Analysts – This section lists the analysts assigned to the case. Analysts can be assigned by selecting the ‘+’ button. Upon selection of this button, a pop-up menu will appear with a list of all admins in your organization. From here, you can search for specific users and select the checkbox next to their name to add them to a case.

Analysts can also be added to a case when a user performs an action on it. Adding an exclusion, clearing an alert, putting a machine into isolation mode, and more will all count as actions being taken on a case.

Alerts

The Alerts section of the Incident Center is the main area where you can view alerts generated for objects in your current case.

MITRE Framework Filters

At the top of the Alerts section is a list of different MITRE categories. Here, you can see immediately whether there are any active alerts in the organization that match one of the frameworks. If there is at least one active alert that matches the categories listed in the current case or that has been discovered in the entire organization, the category will turn red. Additionally, a number will appear under the category name, showing the number of alerts categorized as this.

The number to the left shows the total number of alerts in this category in the case, whereas the number to the right shows the total number of alerts in this category across the entire organization.

By selecting one of the MITRE Framework filters, the Alerts tab will ONLY display alerts flagged as relevant to this category. Selecting the filter again will remove the filter and display all alerts for the case.

All Alerts Popout Window

Located under the list of categories to the right is a button that, when selected, displays a pop-up window showing all active alerts across all machines in the organization.

First, this section provides a selection of filters that allow users to search for specific active alerts:

Start Date - The earliest point in time at which ThreatLocker is indicated to search for active alerts in the case. By default, this filter will be set to 12:00 AM of the current day.
End Date - The latest point in time at which ThreatLocker is indicated to search for active alerts in the case. By default, this filter will be set to 11:59 PM of the current day.
Asset Name - A dropdown with the list of assets in the case you're viewing. By default, all assets will be shown, but users can select to view individual assets by selecting the checkbox to the left of each asset name.
Severity - What severity level the alerts you are searching for have. By default, 'All' will be selected, but users can also choose to view only 'Information', 'Warning', or 'Severe' alerts.
Status - A dropdown field that indicates the alert's current state. By default, "Active" will be selected, meaning it will show all alerts that have not been cleared from the asset. Users will have the option to show only cleared alerts as well, or show both active and cleared alerts.
Search - A search bar that lets users enter keywords that are relevant to alerts.
Search Button - Searches for alerts based on the filters a user has entered.
Clear - Clears all current filters.
CSV Button - A button that allows users to export all alerts that apply to the current filters to a .csv file for easy viewing capability.

Under the 'All Alerts' filters, columns display information about the alerts you are viewing.

Asset Name - The name of the asset that the alert was generated on.
Date/Time - The date and time that the alert was generated on. This matches the organization's time zone.
- If the system time differs from the time the alert was received, the 'System Time' will be shown beneath.

Status - Whether the alert is still active or has already been cleared. Active alerts are denoted by a red chip, wheras cleared alerts will have a green chip.
Occurrences - The number of occurrences for that particular alert.
Threat Level - The total threat level of the chosen alert.
User - The name of the user associated with this alert.
Case Name - The case that the alert was associated with. This field is particularly useful if you are reviewing previously cleared alerts that might have belonged to other cases. Selecting the case name will also bring up either the Case History page for the corresponding case or the Incident Center for the active case.
Policy Name - The policy matching the alert that was triggered. The policy description is included beneath the Policy Name. When hovered over, a tooltip will appear with the full description of the policy.

Severity - The severity level of the alert, which can be 'Information', 'Warning', or 'Severe'.
Action Type - The action type that matches the corresponding alert. The action type is taken from the Unified Audit and provides users with valuable information, such as whether a file was executed, moved, etc.
Action - The official way that this particular alert/log was handled. Users will be able to determine in this area whether the log was permitted or denied. Users can also view whether the log would have been denied, but was permitted because the machine was not secured.
Summary - A summary of the alert that was triggered. The alert details of the policy can also be viewed here by hovering over it.
Full Path - The full path associated with an alert, if one is available.
Exclusion Count - The number of exclusions that are associated with that particular alert. There is a plus button to the right of this field that lets users create a new exclusion using information from the alert.

Configure Columns - A wrench button that, when selected, provides a list of most columns for alerts. By default, all columns are selected; however, you can use this button to add or remove columns as needed to cater to your specific requirements.

Below this section is the list of alerts that match the filter criteria you have entered. To view each alert, select one of the alerts on the list. This will drop down and show all relevant information about the alert. This dropdown provides the same information as the ‘View Full Log’ button on the alerts page. Multiple dropdowns can be viewed simultaneously, and selecting the alert again will close the dropdown.

Alerts Advanced Filter

The alerts section provides users with an advanced filter, allowing you to create a more granular search through alerts in your case.

Search

The search bar lets you search for keywords in the policy name or alert summary. Additionally, each MITRE Framework filter is associated with a label. The search bar lets you find labels related to the MITRE Framework filters.

Advanced Filter

To the right of the search bar is the ‘Advanced Filter’ button. When this button is selected, a pop-up window appears with additional filters you can apply to your list of alerts.

Show Cleared Alerts – This checkbox adds a filter that shows only cleared alerts.

Only Show Evidence – This checkbox adds a filter that displays only alerts added to case evidence.

Filter by Severity Dropdown – Allows you to filter by alert severity, with four options. You can select only one option at a time, and selecting a severity will only show alerts that match that severity.

- All
- Severe
- Warning

Information

Objects With Matching Alerts

To the right of the filter, you will see a button titled 'Objects With Matching Alerts'. This button will identify if other objects (computers or cloud accounts) have generated the same alerts. This will only include objects that have the same set of alerts active at that time, meaning that if two objects have the same alert, but one object contains an alert that the other doesn't, it will not be included in this list.

When at least one object matches another in your organization, a number icon will appear on it, alerting you to the number of objects in the organization that contain matching alerts.

If no objects in the organization contain matching alerts, this button will be grayed out.

When this button is hovered over or selected, a popover window with the list of objects with matching alerts will appear. From here, you can view each object and determine if you'd like to add all objects to the current case.

Enable Auto Refresh

This checkbox is not selected by default. When selected, the Incident Center will automatically refresh the page every few seconds to determine whether any new alerts or information have been generated since you last manually refreshed/loaded the screen.

Group By Policy

Lastly, ThreatLocker provides users with a ‘Group By Policy’ checkbox, which is selected by default. When checked, instead of showing each instance of a policy alerting individually, the policies will be grouped. This view will show you each type of alert that appears in the selected case.

This view will also show you how many times the alert type occurred, along with a timeframe indicating the first and most recent instances of the alert appearing within the organization.

Selecting a grouped policy displays a list of all alerts that match the selected policy within the case.

If the number of triggered alerts exceeds the provided field, a button at the bottom of the list titled ‘View More Alerts’ is displayed. This button opens the ‘All Alerts’ window, which can be configured to display all information related to the policy you selected.

View Alerts in Case/Organization

To the right of the filters, you will see two icons labeled 'View Alerts in Case' and 'View Alerts in Organization'.

By default, 'View Alerts in Case' will be selected when you open a case. This page displays all alerts currently tied to a case, including all machines or accounts associated with it. By selecting the 'View Alerts in Organization' button, you will be able to see other active threats in the organization. These active threats will be presented in a list view with the object name, policy, summary, full log, and date/time the alert was received. If you see another alert in your organization that is related to the case you are in, you can use this area to add the object to the case.

Active Threat - Information about the alert, allowing you to determine if this alert is related to your current case.
Go to Case - This button links to the full case associated with this alert.
Add to Case - This button adds the selected machine and its active alerts to the current case.

Anatomy of an Alert

Alerts on this page will look similar to those on our old version of the ThreatLocker Detect Sidebar. The following section will outline what information is provided within an alert, and what actions can be taken on an alert from the Incident Center:

Object Name – Provides the object name associated with the alert. If the name is too long for the field, you can hover over this area to reveal the full name. A computer or cloud icon will be visible to the right of the object, depending on the type of object that generated the alert. Selecting the object name of an Endpoint Detect alert will open the ‘Computer Details’ sidebar.

Policy Name – This section shows the name of the policy that generated the alert. If the policy was created by a user in your organization, you can select it to open the Edit Endpoint/Cloud Detect Policy sidebar. This allows users to apply policy changes or view the policy's conditions directly from the Incident Center. If the policy is created by ThreatLocker, it will be grayed out and cannot be selected.

Alert Summary – The summary created for the alert. This will typically be a brief explanation of what the alert is for.

View Full Log – A button that, when selected, provides a dropdown with a list of all relevant information from your alert. Information will vary depending on the generated alert, but it provides a quick summary of the logs important for investigating the selected alert.

Received On – Provides the date and time at which the alert was generated on the machine.

Threat Level Impact - The Threat Level that was assigned to the selected alert.

Number of Occurrences – The total number of times that an identical alert would have generated on the machine. This means that the alert generated would have created a separate alert in your organization, but the information in its logs matched identically to the other existing alert. ThreatLocker provides this information visually to show how many times this alert occurred without overloading your Alerts Center.

Exclusion Count/ Add Exclusion – If the policy does not have an exclusion applied to it, this section will show ‘Add Exclusion’ with a ‘+’ button to the right of it. If an exclusion does exist for this policy, this section will show ‘Exclusion Count’, followed by the number of exclusions for this policy in your organization and a ‘+’ button to the right of it.

Alert Severity – The severity level of the alert. This section can display Information, Warning, or Severe depending on the severity that was designated to the policy.

Add to/Remove From Evidence – When a case is closed, a record of the closed case will exist in the ‘Case History’ tab. The Case History window combines information about alerts generated on the objects during the case's active period, Incident History, and Asset Notes. The ‘Alerts’ section here will display all alerts that had ‘Add to Evidence’ selected at the time that the case was closed. By default, ALL alerts with a Warning or Severe severity level will automatically have this button activated, which will include them in the closed case’s history. Information alerts can be added to evidence as well, but must be added manually by selecting this button. This feature allows you to curate your alerts in the event that there are alerts you deem not relevant to the final closed case.

Exclusions

The 'Exclusions' section is found beneath the 'Alerts' section. This is a list containing all exclusions related to the case.

Exclusion information, which includes the policy name, the level the exclusion applies to, what is being excluded, and the expiration of the exclusion, if applicable.
This button can be used to expand or close the 'Exclusions' panel. By default, this panel is closed.
A button that allows you to delete exclusions.

Incident Center Banner

On the Incident Center page, an optional banner might appear in the middle.

There are three scenarios in which this banner will appear, and all three banners can appear simultaneously:

Known Threats Within a Case – This banner appears when an alert in the case contains a known hash or IP address that VirusTotal has classified as a threat. This banner will include a ‘View Threats’ button that filters the Unified Audit in the Incident Center to show results related to the known threat.

Computers in Monitor Mode in the Organization – This banner appears if one or more machines in the organization are in Monitor Mode. This banner will provide a button titled ‘View Asset’, which will take you to the ‘Devices’ page to view the asset that has had Monitor Mode applied to it.

High/Critical Failed DAC Checks in Organization – This banner appears when at least one High Risk or Critical DAC check is failed in your organization. This banner will provide a button titled ‘View DAC’, which will redirect you to the DAC Dashboard to view all failed DAC checks within your organization.

If none of the above situations apply in your environment, this banner will disappear and shift the ‘Task Manager’ and ‘Unified Audit’ sections to the top of the page.

Task Manager

Note: On small screens, this section will not be available. This section will also not be provided if the case only has Cloud assets.

The ‘Task Manager’ section of the Incident Center is located above the ‘Unified Audit’ portion of the page. This section allows you to select between assets in the case to view the current running process list on the device. It is required that the device agent is checking in. This feature is ONLY available for Windows machines. This section is collapsed by default, but selecting the ‘arrows’ to the right of the section will expand it.

Once expanded, a dropdown menu listing all assets in the case will appear. Select this dropdown, then choose an asset to begin loading your process list details.

Note: Please allow some time for the process list to populate, as process list details will load when the machine checks in next.

When the process list is populated, you will see a list of all processes running on the selected machine.

Note: Running Processes will also be displayed in the Unified Audit page every time the Task Manager process list is loaded.

A search bar is available to search for keywords relevant to the processes you are looking for. Additionally, you can refresh the process list for an updated view. The total number of processes that were running on the machine at the time that the list was generated will also be available in the ‘Process Count’ section.

In the process list, you are shown each process run, including the user who ran it, the parent process, and the PID. To the left of each process, you can also see the process size.

If the process is not run by Windows, it can be selected, and a pop-up window will appear. This window lets you kill the selected process by PID or process name. After selecting how you want to kill the process, selecting the ‘Kill Process’ button will kill it on the selected machine.

Selecting the ‘Cancel’ button will close the window.

Unified Audit

Note: On small screens, this section will not be available.

The Unified Audit section is a compact version of the Unified Audit page. The Unified Audit section will be expanded by default, but can be collapsed by using the arrow button to the right of the section title.

This section provides the same Advanced Search filters as in the full version of the Unified Audit. For questions regarding 'Advanced Search', please navigate to the following article:

How to Use Multiple Parameters in a Single Search Field in the Unified Audit | ThreatLocker Help Center

By default, the following filters will be applied to the Unified Audit whenever the Incident Center is opened:

Start Date – 12:00 AM on the current date

End Date – 11:59 PM on the current date

Filter to remove white noise

Individual entries for each Asset Name in the case

A search bar is provided for users to search for keywords associated with Unified Audit logs they are investigating.

To the right of the filter button is a button that, when selected, opens the full Unified Audit page, including the search parameters you specified on this page.

When the Unified Audit logs populate, you will see a list of information, including the asset name, user name, process path, date and time, and Action Type. Selecting any of these logs will open a sidebar that displays the full information for that Unified Audit log.

Asset Actions

The 'Asset Actions' section provides information on the state of all assets in a case during evaluation. Based on the provided information, this can help you further determine if a machine should be remediated or if alerts can be cleared. The 'Asset Actions' section can be found in the top right corner of the Incident Center. The following is provided in this section:

Asset Name - The name of the machine or cloud account. Selecting this button will open the 'Computer Details' sidebar associated with the selected asset.
Asset State - A text field that displays the current state the asset is in. The following messages may appear here based on the asset's current status:
- “This asset is currently Locked Down” - Will appear if the asset is in a Locked Down state.
- “This asset is currently Isolated” - Will appear if the asset is in an Isolated state.
- “This asset is currently Locked Out” - Will appear if the asset is a cloud account that has been Locked Out.
- “This asset is currently Available” - Will appear if the asset is not a Locked Out cloud account, OR the machine is not in a remediated state.
- “This asset has policy actions taken”- Will appear when a policy action is enabled on the asset.
  - If there is a policy action enabled on the asset, you can hover over this field to reveal a tooltip with information regarding the policies that have been applied to an asset while the case is active.

Action Buttons - The 'Asset Actions' section also includes actionable buttons to remediate or clear alerts on an asset.

- Endpoint Detect - Assets belonging to Endpoint Detect will display the following buttons in this area:

- - Lockdown - Makes the asset inaccessible. The asset can still communicate with ThreatLocker.
  - Isolate - Revokes all network activity except for communication with ThreatLocker.
  - Clear System - Clears all alerts associated with the asset and removes remediation.
  - More Actions - An ellipses button that, when selected, opens a dropdown with additional actions.
    - Call - If you made a call while investigating an asset, this button provides a field to add notes from that call. Selecting the 'Save Response' button will add a log to the 'Incident History' section with the notes you added.

- Cloud Detect - Assets belonging to Cloud Detect will display the following buttons in this area:

- - Lockout - Locks the account, preventing users from logging in.
  - Revoke Session Token - Logs the user's account out of all devices.
  - Clear System - Clears all alerts associated with the asset and removes remediation.
  - More Actions - An ellipses button that, when selected, opens a dropdown with additional actions.
    - Call - If you made a call while investigating an asset, this button provides a field to add notes from that call. Selecting the 'Save Response' button will add a log to the 'Incident History' section with the notes you added.
    - Revoke & Lockout - Applies both the Lockout and Revoke Session Token remediation methods simultaneously, making it so that the associated user is logged out of their account on all devices, and that their account can't be logged into.

Incident History

The 'Incident History' section is a comprehensive list of all actions taken on a case. The Incident History updates for every action that is taken on the case. This can include actions such as assigning an analyst to the case, adding an exclusion, clearing the system, remediating machines, and more.

Actions that are exclusive to the Cyber Hero MDR team will also appear in this section. This includes actions such as escalating an alert, sending an email, sending notifications to machines, and more.

Any messages sent by users will be included in this log list as well. This includes emails sent by the Cyber Hero MDR team, as well as the reasons provided for why an asset was remediated.

Once the case is closed, the Incident History will be visible in the Case History page.

Asset Notes

Below the 'Incident History' is the 'Asset Notes' section. This area allows users to enter notes related to alert investigations and serves as a comprehensive reference.

By default, the 'Asset Notes' section will be hidden, but you can use the expand button to display it.

To create a note, enter a note in the field, then use the 'Select Assets' dropdown to choose an asset or assets to apply the note to. Once you select the 'Save' button, the note will appear listing the associated asset, the note, the date and time the note was added, and the analyst who inserted it.

Incident Center Case Tabs

If you have multiple active cases in your organization, ThreatLocker has configured the new ThreatLocker Detect Alert Center to create a separate tab for each case as you open them. Upon selecting a case, a tab will open at the top of the page, visible on the ThreatLocker Detect Alert Center and Incident Center case pages.

These tabs will let you quickly switch between the cases you are reviewing during your investigation. If you no longer need a tab open, you can select the 'X' button to remove it from the list of open tabs.