Events and sourcesEvery event a source reported, grouped by rule and subject, with the case each group was filed under. Read-only: cases are worked under Incidents.
What the sources sent in the last 24 hours, and whether every source is delivering.
What changed on this page
Events, Sources and Exposure are now one destination with three tabs; every address is the same as before.
The five tiles and the state bar are one control: a tile picks the same view as its button. Scope, source, severity, rule provenance, state and sort sit in one Filters panel, and every filter in use is a chip you can remove.
Each row shows its severity as a stripe, its count, its source with the source's state, relative times, and opens a detail drawer. The blind-spot banner names any source the SOC cannot see, on every tab.
Event streamOne row per rule and subject: the events intake grouped under one correlation key and filed under one case. A failing security control is one row per control, account and region, so it can cover several assets; its title then names the control and says how many assets. Count is how many events the row holds in this window; first and last seen are when the sources observed them. New: its case is open and no person’s action is recorded on it. Triaged: a person acted on its case. Closed: its case closed with no person’s action recorded. No case: none was opened for these events. Rule provenance: where the rule its case was matched to came from, a Legacy Provider rule as handed off, one we adapted, or our own.
Export columns
Tick the columns and set their order. Export saves them in this order; Export CSV uses the same choice.
Operational · loading…
Loading events…
An event becomes an incident when a person declares it.Every event is filed under a case as it arrives, linked under Incident; it becomes an incident only when a person declares its case one on the case page, with a basis, and it is dismissed when a person closes its case as a false positive or as benign and expected.
| Event | Source | Severity | State | Count | Seen | Case | Actions |
|---|---|---|---|---|---|---|---|
| Loading events… | |||||||