When closing an alert, don't remove it from the case.
Siemplify does a great job of correlating alerts into cases, and is crucial in some instances to gaining the "bigger picture" context and understand what happened during an incident or set of events. Its alert grouping functionality is also greatly valuable in its ability to reduce analyst workload; Rather than actioning several alerts grouping them into one case to be actioned as one.
When you close an alert in a case of several, that alert disappears from the case it was grouped into, instead being moved into its own case.
There are several downsides to this approach, I'll do my best to outline our perspective on some of these.
(For these examples let's assume we have two cases:
Case A has several alerts grouped together.
When I close an alert in Case A, it gets moved to Case B and closed immediately.)
Loss of context. (This is the biggest issue we face)
- Regardless of the outcome, that alert was valuable context in the bigger picture of case A.
- After the analyst completed their triage and added all of their comments to case A, all of the case notes surrounding their investigation of the alert has now been lost, because case B does not carry any of this information across when the alert is closed. Now, when we go back to review case B we need to manually go back to case A to find any of the triage information.
Siemplify ROI stats are somewhat impacted by itself.
- Because your closed alerts are being moved into a case of their own, your "Alert reduction percentage" dashboard widget looks like Siemplify is barely reducing your alert load when actually it's providing a lot more value.
A better solution (in our opinion):
It would be much more valuable if Siemplify "greyed out" alerts that have been closed so that they're out of the way, without removing them from the context of the original case.
I'm not sure what would be the best way to represent this, but the idea we've come up with would be some way of labelling the alerts in each case with their status, if they are closed.
This could be done by making them a different colour perhaps, or using an icon to identify when the alert has been closed. You could then have a filter option to show or hide closed alerts within a case.
In the situation where you actually want to move an alert to another case, there should be a separate option (maybe a checkbox in the "Close alert" action to say yes, I want to move this alert to another case.)
Keen to hear others thoughts.