View correlated threat events

In the Security Connector activity report, you can identify whether a security connector event correlates to a threat event. Perform the following procedure to view correlated threat events.
Note: This procedure only applies if Enterprise Security Connector is deployed in your enterprise.

How to

  1. In the navigation menu, select Monitoring > Activity. Click the Security Connector tab.
    Note: If you are trying the new Enterprise Center interface, in the navigation menu, select Threat Analytics > Activity > Security Connector.
  2. Filter events as needed. For more information see Filter data based on date and time and Filter event data.
  3. If you haven’t done so already, select a dimension or event criteria.
  4. In the grouped events area, click the arrow icon to show the events associated with a dimension value.
  5. Locate an event that shows View in the Correlated Threat Event column. Do one of following:
    • In the Correlated Threat Event column, click View. You are directed to the Correlated Threat Event for Security Connector Event dialog where event information appears. To show the event in the Threat Events report, click Show in Threat Events.
    • Click a data value in the events table and in the menu, select Threat Events. You are directed to the Correlated Threat Event(s) by Filtered Dimensions dialog where associated events appears. To show these events in the Threat Events report, click Show in Threat Events.