Risk

This article explains the multiple dashboards available under the risk tab of an attack surface exposure module.

The risk tab consists of risky signals generated from multiple assets that are monitored using attack surface intelligence. Signals are generated every second and are automatically updated in the table widget. The leaderboard in the table widget shows the total number of signals in the opened state, closed state, and signals that are auto-closed.

Searching a word in Table widget

Type any text or numeric and hit Enter to display the results in the table widget according to your search words, or if you don't know what to search for, just click on ? to see the search examples in the Search bar.

For example, if you want to find a signal based on its ID, then enter the signal ID in the search bar and hit Enter. Click X next to your search ID to get back to the default view of the table.

Sorting Signals in Table widget

By the following timelines:

• Past 24 hours          -    Displays signals generated for last 24 hours
• Past 3 days             -     Displays signals generated for last 3 days
• Past 1 week            -     Displays signals generated for last 1 week
• Past 1 month          -     Displays signals generated for last 1 month
• Past 3 months        -     Displays signals generated for last 3 months
• Past 6 months        -     Displays signals generated for last 6 months
• Past 1 year             -     Displays signals generated for last 1 year
• All                           -    Displays signals generated for all days from the start date of monitoring your assets

To view signals for the above time lines, click and select any timeline from the dropdown next to View as at the top of the table widget.

By Signal Severity:

• Critical                  -    Affects system functionality drastically and needs immediate attention
• High                     -    Affects system functionally in the coming days and can wait for remediation
• Medium               -     Affects system functionality after some couple of days and can wait for remediation
• Low                     -     Affects system functionality after a couple of months and can wait for                                                   remediation
• All                       -      Signals generated for all severity levels

You can choose one or more than one severity levels to sort out signals in table widget. Unselect your selection to get back to default view of the table.

Changing Signal State

In general, the security team gets overwhelmed with many signals that are not important to pay attention to. In that case, Attack Surface Intelligence UI provides you with the ability to close the signal that is in an open state by analyzing the score and impact of each signal using two methods.

Method 1: Changing the status of a single signal

In this method, you can close only one signal at a time.

To update the signal state to Closed,

• Click the Situation ID.
  A pop up appears on screen.
• Scroll down and click Update Signal Status.
• Select Status from the drop-down list (Closed/Open)
• Choose appropriate option for Close Reason
• Enter Comments
• Click Update
  signal status will be closed
  

Method 2: Changing the status of bulk signals

In this method, you can choose one or a bulk of signal(s) at a time.

To update the signal state to Closed,

• Check mark checkbox next to any signal(s) that you want to close
• Click Update at top-right of the table widget
  A small popup appears on screen
• Select Status from the dropdown (Open/Close)
• Select an appropriate Close Reason that you justify enough to update the status
• Type your Comments in the blank field
• Click Submit
  signal status will be closed