View Triaged or Scored Alerts
You can view triaged alerts in the indexing topic in Apache Kafka or in the triaged alert panel in the HCP Metron dashboard.
An alert in the indexing topic in Kafka looks similar to the following:
> THREAT_TRIAGE_PRINT(conf)
╔═══════════════════╤═════════╤══════════════════════════════════════════════════════════════════╤═══════╤═══════════════════════════════════════════════════════════════════════════════════╗
║ Name │ Comment │ Triage Rule │ Score │ Reason ║
╠═══════════════════╪═════════╪══════════════════════════════════════════════════════════════════╪═══════╪═══════════════════════════════════════════════════════════════════════════════════╣
║ Abnormal DNS Port │ │ source.type == "bro" and protocol == "dns" and ip_dst_port != 53 │ 10 │ FORMAT("Abnormal DNS Port: expected: 53, found: %s:%d", ip_dst_addr, ip_dst_port) ║
╚═══════════════════╧═════════╧═══════════════════════════
The following shows you an example of a triaged alert panel in the HCP Metron dashboard
Investigation Module Triaged Alert Panel
For URLs from cnn.com, no threat alert is shown, so no triage level is set. Notice the lack of a threat.triage.level field.