Investigate an Incident Using the Canvas

Visually map and investigate incidents using the canvas in Cortex XSOAR 6.12.

The Investigation Canvas enables you to visually map an incident, its elements, and progression path, combining analyst intelligence with machine learning.

To access the investigation canvas, click Canvas from the incident you want to investigate. The incident appears on the canvas display. In the Add entity to canvas section, DBot provides suggested indicators and incidents that might be connected or relevant to the current incident for you to add to the canvas.

Searches are server side searches.

canvas.png

Incident Suggestions

The incidents are calculated according to the related incidents algorithm, which are based on several factors:

• Common labels
• Common indicators
• Common incident custom fields

You can add the incidents by dragging and dropping the incident onto the canvas.

Indicator Suggestions

The indicators are determined according to the following factors (in this order):

1. Indicators with a malicious verdict from the original incident (the incident that initiated the investigation).
2. Indicators that are shared between incidents that you added to the canvas.
3. The malicious ratio, which is the ratio between the indicators that appear in incidents with a malicious verdict, compared to the total number of incidents in Cortex XSOAR.

You can add the indicators by dragging and dropping the indicators onto the canvas.

Note

You can Edit Dbot Incident and Indicator Suggestions in the Entity Library.

Key Features

You can do the following:

• Auto Populate the Canvas with related incidents, suspicious URLs and so on by using machine learning.

  The closer an entity appears to the center, the more closely related it is to the investigated incident.
• View an incident and indicator: view details of incident and indicator, including various actions in the Dbot Suggestions: Quick View Window.
• Connect incidents: connect each incident by linking each incident and use comments on entity connections to communicate important information with team members by adding notes to connectors between entities.

  

  link_incident.png
• Dynamic Connections: when you rearrange entities on the canvas, the connections dynamically move with the entities. Connections that are dotted lines indicate that the indicator is part of the investigation, or two incidents are defined as related incidents. These connections are dynamic, which means if one entity is an IP address and you add that IP address to the allow list after it was added to the canvas, the dotted-lined connection is automatically removed.
• Capture the Canvas as an image: capture and study the incident by clicking Export to PNG.

Auto Populate the Canvas

Cortex XSOAR can automatically populate the Canvas with related entities using machine learning. If your canvas is already populated, auto populating it deletes all of the existing content.

1. Go to the Canvas tab of the incident you are investigating and click Auto populate.
2. If you want to customize the canvas, click Customize and select the following:

   • If, and how many, related incidents appear.
   • The maximum distance over which items are included in the canvas in the Similarity Max Distance field.

     By default the distance is set to 0.8. The closer the score is to 1, the less related they are to the incident.
   • Linked incidents
   • Bad and suspicious common indicators
   • Configure the threshold above which an indicator is ignored in the Indicators Ignore Threshold.
3. Click Auto populate.

   The closer an entity appears to the center, the more closely related it is to the investigated incident.

Dbot Suggestions: Quick View Window

The Quick View window displays information for the entity selected on the canvas, either an incident or an indicator, each of which have DBot suggested indicators.

You can highlight entities on the canvas to show visually how the incident progressed.

Searches performed in the Quick View pane are client-side searches.

indicators_canvas.png

Incident Quick View

You can view basic information, such as type, severity, time line information labels, and indicators. The indicators that DBot suggests to add to the canvas for this incident are determined according to the following factors (in this order):

1. Indicators with a malicious verdict from the current (selected) incident.
2. The malicious ratio, which is the ratio between the indicators that appear in incidents with a malicious verdict, compared to the total number of incidents in Cortex XSOAR.

Indicator Quick View

You can view source information, hashes, known history, comments and do certain actions such as run scripts, delete, exclude and so on.

The indicators that DBot suggests to add to the canvas for the selected indicator are determined according to the following factors (in this order):

1. Relations between all canvas investigation contexts. For example, if a hostname and IP address are associated with the same endpoint, the context key is suggested as an indicator.
2. An ssdeep with 50% or higher similarity.

You can Edit Dbot Incident and Indicator Suggestions in the Quick View window.

Edit Dbot Incident and Indicator Suggestions

In the Investigation Canvas, Dbot provides suggestions in the Entity Library section and the Quick View window. You can change these suggestions by adding keys and values when adding a server configuration.

1. Select Settings → About → Troubleshooting → Add Server Configuration.
2. Add the following keys and values as required:

   Key	Description
   canvas.suggestions.IncidentIndicatorSuggestions.max	Maximum number of suggestions for malicious suggestions. Default: 5 Relevant for Library and Quick View.
   canvas.suggestions.IncidentMutualIndicatorSuggestions.max	Maximum number of suggestions for common indicators between incidents. Default: 5 Relevant for Library and Quick View.
   canvas.suggestions.IndicatorIndicatorSuggestions.max	Maximum number of suggestions for indicators. Default: 5 Relevant for Quick View.
   ml.suggestions.canvas.leftpane.incidents.limit	Maximum number of incidents in the Quick View window. Default: 10 Relevant for Quick View.