[Autogenerated] I've already created some alerts and they are stuck within
the queue waiting for an analyst to be able to triage them.
So if I were to click on the first one here,
which is in relation to brute force,
I'll preview this alert and import it to a potential new case.
I see that this relates to a brute force attack and
if I go to my alert page here,
I can see that there's a brute force attack template that I can use.
So I'll use that template and then I'll hit import notice that KIW creates
a case for me and then it redirects me to that case,
it assigns it to myself since I'm the analyst that just triage that alert and
it thinks I'm going to be the one investigating it further.
This template here is a template that have created earlier which
correlates to this particular type of alert.
So in essence I'm saying that the Hive will use this as its default
template every time it sees a brute force alert,
like the one that I assigned this template to.
The template gives me a particular set of tasks which relates
to actions like check Active Directory logs.
So all of these things can be envisioned as a checklist of items that an
analyst can have in order for them to perform specific actions,
you can see them as a playbook for the analysts and particular
notes can be taken in each step of the way.
If you want to create your own templates,
you can hit the organization option and then if you go to case templates,
you see some that have already created.
But if you hit new template,
then you can create additional templates of your own really,
really crucial information that you can have here.
They can cut down on the investigation time,
because you can actually allow tasks to be already included within
the template versus the analyst having to retrace their steps every
time now onto some useful metrics.
We saw some basic case handling and some basic alert handling.
What about some useful metrics about what's going on?