Incidents
AMTD Incidents lists threats and response operations observed by protectors, with severity, affected application/user/host, classification, review status and trajectory.
AMTD Incidents lists threats and response operations observed by protectors, with severity, affected application/user/host, classification, review status and trajectory.
Overview
Section titled “Overview”The overview summarises incident severity and review state. Incidents are live AMTD data, not UEC alert rows; use it to understand AMTD-specific protection and response history.
Columns
Section titled “Columns”| Column | Meaning |
|---|---|
| Severity | Critical, high, medium, low |
| Application | Affected application |
| User | Account context |
| Alert Time | When AMTD raised the incident |
| Hostname | Endpoint |
| Operating System | Windows/Linux/macOS |
| Response Operation | AMTD response action |
| Review Status | Operator review state |
| Classification / Category / Sub-category | Threat taxonomy |
| Incident ID | Upstream identifier |
| Group / Protector Version / Build-Kernel | Deployment context |
Filters and review
Section titled “Filters and review”Filters include severity, alert time, OS, application, user, hostname, response operation, review status, classification, category/sub-category, group, protector version, and build/kernel. Search and column selection keep large result sets manageable.
Review actions and AI commands are pass-through operations against AMTD. Record the incident ID and reviewer in the case ticket so the AMTD action can be traced later.
Incident trajectory
Section titled “Incident trajectory”Open an incident to view its trajectory: the sequence of events, affected objects and MITRE context where available. The trajectory is evidence for what AMTD changed; use UEC Events and Alerts to see related endpoint telemetry.