Understanding and investigating alerts
I feel like we're at the cusp of what we've all been waiting for, and that's digging into alerts to see what's going on and what we can do about it. But before we do that, there's one last thing I want to cover and that's ensuring we know all aspects of the alert itself.
When it comes to the structure of the alert, we're presented with What happened on the left-hand side of the page, and it reads sort of like a timeline. On the right-hand side of the page, we get more of the details, such as detection source, activity timestamps, description, and entity types involved. You'll often see a link to a docs page that tells you more about that alert type.
Another thing you'll notice is if the alert is a part of an incident, there are mentions of the entities involved. See Figure 7.24 as an example:
Figure 7.24 – Alert structure example
Starting with a breakdown of the...
