In this lecture I will explain about how to categorize events in screen so as we have noticed that the
first two group groups of events are likely virus infections.
So it would be useful if we can't categorize events and view events for each category.
So for example I clicked on the query menu and then query by category and then select pharaohs fiction
category or Category 7
and then I have to change the date to include the
events that the alerts were generated and then I will click on submit.
We see that we do not have any results and this is because we.
Well we have not categorize events yet so we have to do that beforehand
so I will close the query builder and I will right click on the event
and then I will choose update event status and then I will
choose the category 7 or forest fiction category
and we see that the event disappeared from the queue here because it is moved to Category 7.
Now if we debated the query again so query by category and then Paris and fiction or Category 7 and
then I have to change the date and then click on submit.
Now we see that we have those 24 rows that we have categorized them to be in Category 7 and we can execute
the query also by right clicking on the alert and then select advance query.
And then the category that we are searching for and we see that the same window for the query builder
was opened.
So then we can change the date and then click on submit to get the same results.
Another way is by right clicking on the alert and then choose quick query and then Paris fiction.
And here we see that we have gotten zero rows because the date.
So we have to click on it and then we see also that we have we have gotten the same query builder window
so we will change the date and then get the same results
and you can categorize events quickly by using the F keys so you might notice that the partisan fiction
category has an F saving key here.
Therefore if I click on an event for example this one and then I can assign it too far as some fiction
category by breaking the F seven key.
So we see that the event disappeared now from the Q because it is a it has been assigned to its new
category of pyros and fiction
and here below we see other THC or the L L in Windows 5 download events
which are once and I can categorize those but I will rather do that in squid
also in addition to the event category we can escalate the event so events will appear under the escalated
event step to be reviewed and analyzed by a higher level security analyst who can assign them to a specific
category if needed.
Or might it determined that it was a false positive for example.
So for example I will escalate those two events so I will right click them and then select
escalate and then I can't type for example e e download as a comment
and we see that the events disappeared from the queue and you can find them under the escalated event
step.
And also we can add a comment for an event by right clicking on the event and then update event status
and maybe add a comment.
That is belonging to a specific category.
And sometimes you might find it useful to do these categorization automatically for repeated events
especially those who think they are false positives which will save your time and allows you to focus
on the more suspicious events.
So for example if I right clicked on this event and then select three it or cut from event and then
I can set a period for that auto card categorization.
So let us start as three hours and then I have to set the category which is by default category 1 or
the in a category and the other seven categories have the numbers from eleven to 17 so I will click
on submitter
so in this picture I have explained about how to categorize events in screen and in the next picture.
We will explore.
Script.