View Sightings Search Results

You can review Sightings Search Results for internal and external malicious indicators.

Before you begin

Role required: sn_si.analyst

About this task

.

Procedure

1. Navigate to a security incident.

2. Select the Sightings Search Results tab from Show IoC Related List group to view the list of sightings searches.

   Note: This data can be shared with Trusted Security Circle.

   Result	Description
   Number	Sightings Search identifier.
   Observable count	Number of observables searched for.
   Internal Sightings	Aggregated count of internal sightings.
   External Sightings	Aggregated count of external sightings. (Received from threat sharing.)
   Matched configuration items	Aggregated count of configuration items that matched an existing record in your cmdb.
   Start date range	Time to start looking for sightings.
   End date range	Time to stop looking for sightings.
   Updated	Date and time of last modification.

   To view the details of a single search:

3. Select a Sightings Search reult in the Sightings Search Results list.

   The Sightings Search Result form displays.

   Detail	Description
   Number	Internal Sightings Search identifier.
   Observable count	Count of observables searched for by this query.
   Internal sightings	Count of internal sightings for this search.
   External sightings	Count of external sightings for this search. (Received from Trusted Security Circle.)
   Unmatched hosts	List of potential configuration items for this search that were not matched with any records in your cmdb.
   Task	Security incident task identifier.
   Start date range	Time the sightings search started.
   End date range	Time the sightings search stopped.
   Updated	Date and time of last modification.
   Sightings Search Details	Type, number of sightings and modification date.
   Matched Configuration Items	Count of configuration items that matched an existing record in your cmdb. Lists the CI and the Sighting.
   Threat Shares	List of the threats shared with Trusted Security Circle.

4. Share Sightings Search results
   You can share local sightings details or results that are associated with a particular search with your Trusted Security Circle.

5. Share observables from a security incident
   Observables can be shared from a security incident in Security Incident Response to members in your trusted circle.

Parent Topic:Create sightings search configuration records