After you retrieve XDR data, you can explore the data on the Alert Triage page.
The Alert Triage diagram displays network nodes (domain or IP) that highlight IDS-specific network connections.
In the bottom pane, select the Observations tab to view the following fields:
- Time that the observation occurred
- Reason for the observation. This is a more detailed view than was previously available with Enriched Events.
- Username who executed the process that triggered the observation
- ATT&CK Tactic & Technique
- Available Actions
MITRE ATT&CK tactics and techniques and other netconn data display in the Observations Details pane that opens when you expand the alert.