Workbench Alerts and how to view them
The Workbench serves as a crucial tool for monitoring and responding to security alerts. By analyzing these alerts, your security teams can swiftly identify suspicious activities and respond effectively to mitigate risks-allowing you to stay ahead of the threats.
Where to find your Alerts
1. Log into the Trend Vision One™ console: https://signin.v1.trendmicro.com
2. Navigate to “XDR Threat Investigation” on the left-hand menu and select “Workbench”
Take on Workbench Alerts with Confidence
Your workbench page lists alerts that need your immediate investigation, ranked by severity score to help prioritize your responses. Click on an alert for detailed information, including the threat's nature, affected systems, and recommended actions.
Follow the steps below to start tackling workbench alerts effectively to quickly respond and remediate the impact of adversaries.
Review Highlights
Select the Workbench and examine the highlights to better understand what is contributing to the alert and the associated MITRE ATT&CK technique to deepen your understanding.
This video drills into alert specifics, viewing severity scores, and understanding the entities involved.
Explore and Analyze
Select the highlight within the alert, it will then show the associated nodes that you can drill into for deeper insight or response actions.
This video shows how to view detailed insight information, including the graphical view and highlighted objects, which are crucial for analyzing the relationships and deeper aspects of the alert.
Check Execution Profile
From the drilldown list, select the “Insight-Based Execution Profile.”
In here, you can see the host name, criteria, and observed attack techniques mapped to the MITRE ATT&CK framework. By correlating and grouping related alerts, the Insight-Based Execution Profile visualizes objects and events on multiple analysis chains to facilitate interactive investigation.
Evaluate Response Actions
Based on the logs, artifacts, and any suspicious activities with the affected systems, you can now determine and initiate the proper response actions.
The controls you put in place will vary widely depending on the outcome of your analysis in the previous steps.
Connect with our Customer Success team
Our team is equipped to guide you through the intricacies of Trend Vision One™, ensuring that your cybersecurity measures are optimized for maximum effectiveness.