Incident Monitoring

Steps:

1. Accessing the Incident Monitoring Dashboard:

   • Log into the platform using your admin credentials.
   • Navigate to the Audit Module from the side menu.
   • Select Incident Monitoring to view the real-time list of security events and alerts.

   

   
   

2. Viewing Incidents:

   • Once on the Incident Monitoring page, you will see a the overview tab that summarizes the recorded incidences
   • Beside the overview tab is the logs tab that shows the incident table with incidents listed in chronological order.

   

   
   
   • The events monitored are failed login using biometrics and login from unusual location
   • Each row displays incident details such as the Event Type, Number of attempts, Device, Location, and Timestamp.

3. Filtering Incidents:

   • Use the filter options at the top of the page to narrow down incidents by parameters such as date, device, biometric type.
   • You can also search for specific incidents using keywords.

4. Investigating an Incident:

   • Click on any incident row to view more details about the event.
   • Here, you will find in-depth information such as logs, affected user, details of the location, biometric type and biometric details of the person that made the attempt
   • Use the ‘Deep search’ feature to search through the organization to see if the failed login attempt was made by any member of the organization

   

   
   

   • If the attempt was made by a member of the organization, the details of the user will be displayed

     

   • Review all the provided details to understand the cause and potential impact of the incident.

5. Generating Incident Reports:

   • Use the export tool on the logs table to generate a summary report of incidents over a specific time range.
   • Click the Export button, select the desired time frame, and choose the output format (PDF, CSV, etc.).

   

   
   

6. Incident Notifications:

   • Set up email to alert team members when a new incident is detected.

   On the top right corner of the Incident Management module, click on the ‘Alert Settings’ and configure the recipients and the event type you will want them notified for