Working with incident card

The incident card is deleted one month after it was created.

The incident card provides information required to analyze the incident, as well as perform actions in response to the incident.

The following information is displayed in the incident card:

• Threat development chain graph. The graph displays the chain of actions in the system that result in the incident.
• General incident information.
• Information about the device on which the incident occurred.
• Information about the object detected during the incident.

You can perform the following actions on the incident card:

• Isolate the device on which the incident occurred.
• Prevent execution of file detected during the incident.

  You can also use the standard Kaspersky Security Center Web Console tools to add a file to Kaspersky Endpoint Security for Windows Application Launch Control white list or send a file to Kaspersky experts for analysis.

In this section Configuring a threat report for viewing incident cards Prerequisites for creating threat development chain Viewing the incident card Selecting an action on a file from the incident card Isolating a device from the incident card Creating IOC Scan task from the incident card

Page top