Triage workflow
في هذه الصفحة
From a new case to a decision on every entity: the workflow that turns a fleet of runs into an assessment.
The four triage states
State | Means |
|---|---|
| Not looked at yet. |
| Looked at; no decision yet, or nothing to decide. |
| Explained and harmless - with a note saying why. |
| Part of the incident, or needs deeper analysis. |
A decision is made on an entity on a host, covers all its signals, and records who made it, when, and the note. Every change is kept in its history. If a later collection brings new signals about a triaged entity, the console shows them as new since triage.
The workflow
-
Create the case and bring the runs in
Cases, New case; then push or import every host in scope. In the Community edition (no cases, no push), upload every host's run on the Import page.
-
Check what could be seen
Overview's Telemetry coverage: which hosts had auditing off, which logs were missing. Note the hosts where a quiet run proves little.
-
Start with the critical and high
Signals, filtered to critical and high, sorted by severity. Open each entity: its signals, graph and timeline on one page.
-
Use the fleet
For each entity, on hosts: is it on one host or many? A program on every host is usually software; on one host it may be the intruder's.
-
Decide and write the note
Benign with the reason, or escalated with what you found. A note is what the report quotes.
-
Pivot
Every escalated entity gives pivot points - a hash, an address, an account. Add them to the case's profile and re-run Signal across the fleet: Scope finds the other hosts.
-
Review the data pages
Autoruns, Applications, Extensions, Remote Access: mark each reviewed per host once you have stacked it.
-
Report
Reports: write the summary, generate the Word or PDF report.
Suppression rules
When the same benign signal appears across the fleet - your backup agent's service, say - an analyst can write a suppression rule in the console, with why. Suppressed signals count nothing towards risk, stay visible under "suppressed only", and appear in the report with their reason.
VirusTotal
An admin can give the console a VirusTotal API key (Settings). The console then looks up the hashes, addresses and domains of the case's entities in a background queue and stores the answers. An entity VirusTotal calls malicious or suspicious carries a red VT mark - VirusTotal's answer, never Signal's finding.