Skip to main content
Version: 6.2

Cyber Security: Incident Manager

The module's rules register detected threats in Incident Manager as Security Incident incidents. The incident card contains affected hosts and accounts, key event fields, a MITRE ATT&CK technique, and an investigation playbook. The playbook helps analysts identify which rule triggered, which fields to check, and how to distinguish an attack from legitimate activity.

Incident Card Structure​

  • title contains the rule name and primary context: the host, user, source, or attack target
  • tags show the module, data source, and MITRE ATT&CK technique
  • description explains what the rule detected, why it is dangerous, and the context of the specific detection
  • additional fields contain event values: the times of the first and last events, the number of events, hosts, accounts, processes, and command lines
  • incident details contain an investigation playbook that identifies the source events, fields to check, and criteria for assessing whether the activity is legitimate

Incident Examples​

Kerberoasting: RC4 Ticket Requests for Multiple Services​

The rule detects an account that requests Kerberos service tickets encrypted with RC4 for multiple services within a short period, based on domain controller events.

The card shows the account that requested the tickets, source address, domain controller, list and number of requested SPNs, and ticket encryption type.

Shadow Copy Deletion Using Operating System Tools​

The rule detects deletion of volume shadow copies and reduction of shadow copy storage using built-in Windows tools. Ransomware may delete shadow copies before encrypting files to prevent recovery.

The card shows the command line, process and parent process, user, and host.

Scheduled Task Creation and Deletion Within a Short Period​

The rule finds a scheduled task that was created and deleted within a short period.

The card shows the task name, command, user, host, and creation and deletion actions. The playbook lists legitimate cases, such as tasks created by software installers and updates, and helps distinguish them from an attack.