View Insight Incidents Details

You can view and access extensive incidents in the Respond > Incidents view. This procedure shows you how to access the Insight Incidents list. You can filter this list to view only the Incidents of interest.

To View Insight Incidents Details

  1. Log in to the NetWitness Platform.

  2. Go to Respond > Incidents.

    View Insight incidents

The following table describes the columns in the Incidents List.

Column Description
Created Shows the creation date of the incident.
Priority Shows the incident priority. Priority can be Critical, High, Medium, or Low. For Insight Incidents, it is Low and Medium.
Risk Score Shows the incident risk score. The risk score indicates the risk of the incident as calculated using an algorithm and is between 0-100. 100 is the highest risk score.
ID Shows the automatically created incident number. Each incident is assigned a unique number that you can use to track the incident.

Note

By default, Incident IDs will appear as (None). To generate Incident IDs, you must enable the Incident Rules. For more information, see the topic Enable Insight Incident Rules.
Name Shows the incident name. The incident name is derived from the rule used to trigger the incident. Click the link to go to the Incident Details view for the selected incident. For example, NetWitness Insight for Asset category change over time.
Status Shows the incident status. By default, for Insight, it will display new status.
Assignee Shows the team member currently assigned to the incident.
Alert Shows the number of alerts associated with the incident. An incident may include many alerts. A large number of alerts might mean that you are experiencing a large-scale attack.

For more information on Incidents, see NetWitness Respond User Guide.

See also