Incident entities results
When you click on an incident, the incident events and entities are displayed. Click on
Entitiesto show the entities involved in the incident:
The default view displays the entity type, entity name, the IP address of the entity, its path, the user associated with the entity, and the date when the entity was first seen in the incident. Use the column selector to add or remove columns as desired.
Columns that can be sorted show an arrow next to the column name.
Each row can be expanded to show additional details:
Entity names are displayed as links. Clicking the link takes you to a separate page that contains additional information about the entity.
Any of the data can be easily copied to the clipboard. Hover the cursor over the datum to be copied and click the copy-to-clipboard icon.