Step 10. Searching for related events
You can expand your investigation scope by searching for events of related alerts.
The events can be found in the KUMA event database manually or by selecting any of the related alerts and clicking Find in events in the alert details (Incidents → the relevant incident → Related alerts → the relevant alert → Related endpoints → Find in events). The found events can be linked to the selected alert, however, the alert must be unlinked from the incident before that.
Example As a result, the analyst found the A new process has been created event, where the command to create a new registry key was recorded. Based on the event data, the analyst detected that
As a result, the analyst discovered that the file was downloaded from an external source using the Search for the related events for each incident alert allows the analyst to identify the entire attack chain. |
