View correlated threat events
In the Security Connector activity report, you can identify whether a security connector event correlates to a threat event. Perform the following procedure to view correlated threat events.
Note: This procedure only applies if Enterprise Security Connector is deployed in your enterprise.
In the navigation menu, select
. Click the Note: If you are trying the new Enterprise Center interface, in the navigation menu, select .
- Filter events as needed. For more information see Filter data based on date and time and Filter event data.
- If you haven’t done so already, select a dimension or event criteria.
- In the grouped events area, click the arrow icon to show the events associated with a dimension value.
Locate an event that shows
View in the Correlated Threat Event column. Do one of
- In the Correlated Threat Event column, click View. You are directed to the Correlated Threat Event for Security Connector Event dialog where event information appears. To show the event in the Threat Events report, click Show in Threat Events.
- Click a data value in the events table and in the menu, select Threat Events. You are directed to the Correlated Threat Event(s) by Filtered Dimensions dialog where associated events appears. To show these events in the Threat Events report, click Show in Threat Events.