Skip to main content

Security Insights Report - What's in the Incident Log?

Dale Adamiak
  • Updated

Team: Huntress Managed Endpoint Detection and Response (EDR)

Summary: The Incident Log lists the incidents behind the numbers in the Security Insights Report, with what happened and what Huntress did about each one.

In this Article

Overview

Which Incidents Appear

What Each Entry Shows

Remediations vs. SOC Remediations

Related Articles

Overview

The Incident Log is the last page of the Security Insights Report. For each incident, it answers three questions: what happened, how serious it was, and what Huntress did about it. To open it from the Executive Summary, select View this report's incident log.

Which Incidents Appear

The Incident Log uses the same rules as the incident counts in the rest of the report. It lists incidents that meet all of these conditions:

  • The incident was resolved during the reporting period, including incidents opened or sent in an earlier period.
  • The incident is Critical or High severity. Low-severity incidents aren't included.
  • The incident belongs to an organization that was in the account at the end of the reporting period.

Incidents from organizations that were moved or deleted don't appear, and the page notes this. If no incidents were resolved during the period, the report doesn't include an Incident Log.

Each page holds three incidents. When the log runs longer, the following pages are titled Incident Log (continued).

What Each Entry Shows

Each entry summarizes one incident. This table describes each part:

Part What it shows
Title The severity and the affected endpoint or identity, for example Critical - Incident on WS-FINANCE-01
Product The product that detected the incident, such as Managed EDR or Huntress Managed Identity Threat Detection and Response (ITDR)
Date and organization The date Huntress sent the incident report, and the organization the incident belongs to
Summary A description of what happened and what Huntress did
Remediations The number of remediation steps, grouped by type, or No Remediations

The date is the date Huntress sent the incident report, so an incident sent before the reporting period and resolved during it shows an earlier date. Remediation steps are grouped by type, such as Revoke All Sessions or Disable Identity. All steps for you to complete are grouped into one row for manual remediations.

To see an incident's full timeline or export it as a PDF, open the Huntress Incident Report in Huntress. See Huntress Portal - Incident Report Timeline and PDF Export.

Remediations vs. SOC Remediations

The Incident Log and the rest of the report count remediations differently:

  • Remediations in the Incident Log include every step on the incident, including steps for you to complete.
  • SOC Remediations on the Executive Summary and product pages count only the remediations Huntress completed.

For example, an incident has seven steps for you to complete, plus one Revoke All Sessions and one Disable Identity that Huntress completed. The Incident Log shows nine remediations for that incident, and SOC Remediations counts two.

These articles explain incident reports and the rest of the Security Insights Report: