In the Security Connector activity report,
you can identify whether a security connector event correlates to a threat event.
Perform the following procedure to view correlated threat events.Note: This procedure only applies if
Enterprise Security Connector is deployed in your enterprise.
How to
-
In the navigation menu, select
. Click the Security
Connector tab.
Note: If you are trying the new
Enterprise Center interface, in the navigation menu, select .
-
Filter events as needed. For more information see Filter data based on date and time and Filter event data.
-
If you haven’t done so already, select a dimension or event criteria.
-
In the grouped events area,
click the arrow icon to show the events associated with a dimension value.
-
Locate an event that shows
View in the Correlated Threat Event column. Do one of
following:
- In the Correlated Threat
Event column, click View. You are
directed to the Correlated Threat Event for Security Connector Event dialog
where event information appears. To show the event in the Threat Events
report, click Show
in Threat Events.
- Click a data value in the
events table and in the menu, select Threat
Events. You are directed to the Correlated Threat
Event(s) by Filtered Dimensions dialog where associated
events appears. To show these events in the Threat Events report, click
Show in Threat
Events.