Examine the entity and users

Perform detailed examination of source entities and users following alert review to identify potential security threats, malware, vulnerabilities, or unauthorized activities that triggered the alert.

This task is part of a workflow defined in Alerts based on firewall events.

After you review the alert in the Secure Cloud Analytics portal UI, you can perform an additional examination on a source entity directly, any users that may have been involved with this alert, and other related entities.

Procedure

Step 1	Examine the source entity location and access logs Determine where the source entity is on your network, physically or in the cloud, and access it directly. Locate the log files for this entity. If it is a physical entity on your network, access the device to review the log information, and see if there is any information as to what caused this behavior. If it is a virtual entity, or stored in the cloud, access the logs and search for entries related to this entity. Examine the logs for further information on unauthorized logins, unapproved configuration changes, and the like.
Step 2	Examine the entity for malware and vulnerabilities Examine the entity. Determine if you can identify malware or a vulnerability on the entity itself. See if there has been some malicious change, including if there are physical changes to a device, such as a USB stick that is not approved by your organization.
Step 3	Investigate user involvement Determine if a user on your network, or from outside your network, was involved. Ask the user what they were doing if possible. If the user is unavailable, determine if they were supposed to have access, and if a situation occurred that prompted this behavior, such as a terminated employee uploading files to an external server before leaving the company.
Step 4	Enter a Comment on this alert, then click Comment Leave comments as to your findings from the alert detail.

You have examined the source entity, users, and related components to identify potential security threats and documented your findings in the alert comments for future reference and investigation tracking.