Threat Review Detail

Information and detail of a Threat Review are presented within the Samurai MDR portal. In this article we walk through elements of each Threat Review.

Summary

Summary information of the Threat Review including status, start and end date. These dates will align with you Samurai MDR subscription (i.e quarterly or monthly) please review How often are Threat Reviews conducted?

tr_timing.png

Figure 1: Example Summary data

Metrics

For the given Threat Review period, various widgets will be displayed providing you insight to the service. This includes:

Monitoring, Detection & Response Summary

The funnel summarizes:

  • telemetry ingested (events) by the Samurai platform from your configured integrations
  • the security detections (alerts) made by the Samurai platform detection engines and third party vendors which are triaged and investigated by the Samurai SOC
  • the number of security incidents reported to your organization

The funnel infers the value of the service based on the data analyzed focusing on detecting and reporting threats to your organization.

security_funnel.png

Figure 2: Example Monitoring, Detection & Response summary for the period

Licence usage

Two charts display your utilized data quota (in Gigabytes GB) against your data subscription (an aggregated quota typically based on number of endpoints subscribed). Any overages or under utilization is discussed with you during the Threat Review meeting.

licence_usage.png

Figure 3: Example Licence usage for the period

Alerts

A donut chart showing the alerts per detection method over the Threat Review period. For a brief explanation of the detection engines please refer to Alerts

tr_alerts.png

Figure 4: Example Alerts per detection method chart

Security Incidents

A chart depicting security incidents reported by severity within the Threat Review period.

tr_security_incidents.png

Figure 4: Example Security incidents per severity chart

Security Incidents

New Security Incidents

Presented in the table are all Security Incidents reported during the Threat Review period.

Click on a Security Incident and you are redirected you to the Situation Room relevant to the Security Incident. Refer to The Situation Room for additional information.

new_security_incidents.png

Figure 5: Example New security incidents table

Highlighted Security Incidents

Any Security Incidents that the SOC determine require attention and discussion during the Threat Review meeting will be included here in table format.

General Tickets

Presented in the table are all general tickets which were created within the Threat Review period.

Click on a General Ticket and you are redirected to the ticket details. Refer to Getting Help for additional information.

New General tickets

new_general_tickets.png

Figure 6: Example New general tickets table

Highlighted general tickets

Any General Tickets that the SOC determine require attention and discussion during the Threat Review will be included here in table format.

Other

Any other topics outside of a standard Threat Review are displayed here, for example a client working with a dedicated Cybersecurity Advisor (CSA) with specific requests may be documented here.

Action Points

A list of current Action Points based on all Threat Review, for example recommendation that have been made which may require your action.

action_points.png

Figure 7: Example Action points table