Part of Defend, in progress — Threat Intel and Security are now part of Defend, not separate products. This area is still being built: some screens, menu names and actions described here may not be available yet, or may still show the older Threat Intel or Security names.
Detection availability: Detection evaluation is currently limited and may not be live in your environment, so alerts may not appear for activity on enrolled devices. No alerts does not mean a device is clean.
An incident is a case that groups one or more related alerts into a single investigation workspace. Incidents give analysts a structured place to track the full scope of an event, assign ownership, coordinate response actions, and maintain a documented record from detection through resolution.
Incidents can be created manually from an alert, or automatically by the correlation engine when it identifies a pattern across multiple alerts.
Incident Lifecycle
Incidents move through three statuses:
| Status | Meaning |
|---|---|
| New | Incident has been created but investigation has not started |
| Investigating | Actively being worked — at least one analyst has opened it |
| Resolved | Threat has been contained and the case is closed |
Creating an Incident from an Alert
- Open the alert you want to escalate. See Investigating Alerts for how to triage first.
- Click Convert to Incident.
- Set the incident title (defaults to the alert title), severity, and category.
- Assign the incident to yourself or a teammate.
- Click Create. The originating alert is automatically linked.
Correlated alerts the engine has already grouped with this one will be included in the incident's linked alert list.
Working an Incident
Open any incident from Defend → Incidents to access the full detail view.
Timeline — all linked alerts shown in chronological order. Use the timeline to reconstruct the attack sequence and identify the initial access point, lateral movement, and any impact.
Linked alerts — the full list of alerts attached to this incident. Add additional alerts by clicking Link Alert and searching by ID or title. Remove an alert that was incorrectly grouped by clicking the unlink icon next to it.
MITRE mapping — technique IDs attached to the incident, drawn from the linked alerts. Review these to understand which stages of the MITRE ATT&CK framework are represented.
Response actions — from the incident, you can take direct action on affected devices (when RMM integration is active):
- Isolate device — cuts network access to the device while keeping it manageable
- Kill process — terminates a specific malicious process by PID
- Forensics snapshot — collects a point-in-time capture of running processes, network connections, and open files
Escalation — use the Escalate to PSA action to create a ticket in your PSA system tied to this incident. See Integrations for PSA setup.
Notes — add notes at any point. Notes are timestamped and attributed. Record your findings, actions taken, client communications, and resolution summary here.
Assignment and Collaboration
- Any incident can be assigned to one analyst at a time using the Assign button.
- Multiple analysts can add notes and work the incident simultaneously; assignment indicates primary ownership.
- When handing off an incident, update the assignee and add a note summarizing current status.
Resolving an Incident
- Confirm all linked alerts have been triaged and all response actions are complete.
- Write a resolution summary in the notes — what happened, how it was contained, and any follow-up needed.
- Set status to Resolved and click Save.
- Resolved incidents remain in the record and can be reopened if new related activity is detected.
FAQ
What is the difference between an incident and a finding? An incident is a time-bounded investigation triggered by one or more alerts. A finding is a durable issue — often surfaced through a scan or assessment — that represents an ongoing vulnerability or compliance gap. Findings are managed separately under Findings and may not have a corresponding alert.
Can the correlation engine create incidents automatically without analyst input? Yes. The engine runs every 5 minutes and groups alerts that share common indicators (device, user, IP, MITRE technique). When it creates an incident automatically, it shows up in the New state with source listed as system correlation. Review and assign it like any other incident.
How do incidents relate to compliance?
Defend's Prove → Compliance Evidence page shows which framework controls Defend telemetry can evidence. Compliance programs, findings, and audits are in CyberAssure. See Security reports and compliance evidence in Defend.