Threat Investigations
What are Threats?
Threats are events that have threat information. Threat information is added to an event if and only if the event triggers a Pattern that has the action to "Create Threat" enabled.
Any search can be easily transformed into detection logic and deployed as policy through Policies and Profiles. To get started with searching, view one of the guides below.
Using the Threat Viewer
The Threat Viewer is the visual representation of a threat event and any surrounding events for the same user. This feature is particularly useful to investigate a threat event at a high-level.
Responding to a Threat
During or after investigating a threat event, response actions may be taken.