Chapter 9

1. To change the incident's view to show In Progress only, go to the Search and Filtering section and under the Status dropdown, select In Progress.
2. An incident's severity can be viewed in two ways: the first way is by looking at the colored strip at the top of the page and the second is by looking at the Severity dropdown.
3. In the Incident Detail pane, if the Investigate button is grayed out, this indicates this incident has no entities.
4. To get the full details of an alert, follow these steps:
5. Find the incident in the incident list.
6. Click on the View full details link.
7. In the Alerts tab, click on the alert's ID.
8. Look at the incident's detail pane and under the Analytics rule entry will be a link to the analytic rule that created this incident. Click that link to be taken into the analytic rule's configuration.