Skip to main content

Detection & Response


Case List

The Case List screen in the SmartWAN Portal, accessible under the "Detection & Response" section, provides a detailed list of cases generated by analyzing event logs. This screen allows users to view and manage security and network-related incidents efficiently.

image.png

Key Features
  • Filters and Search:
    • Customer and Asset Selection: Dropdown menus at the top (e.g., "Select a customer," "Select an asset") to filter cases by specific customers or assets.
    • Date Range: A date picker to filter cases within a specific time period (e.g., 2024/09/30 - 2024/10/30).
    • Advanced Search: A button on the right to access advanced search options for more granular filtering.
  • Case Summary:
    • Displays the total number of cases (e.g., 279 cases) and the total results (e.g., 2,193 cases) for the selected filters.
  • Case Table:
    • A table listing cases with columns such as:
      • Event Type: Type of event (e.g., Raw Packet).
      • Source Asset: Source of the event.
      • Destination Asset: Destination of the event.
      • Rule: Applied rule.
      • Source IP: Source IP address.
      • Destination Port: Destination port.
      • Time: Timestamp of the event.
      • Raw Packet: A column with a clickable icon to view raw packet details (e.g., BSX525D9252F...).
  • Notification Settings:
    • A "Notification Settings" button at the top-right corner to configure alert preferences.

The items provided in the Case List may be modified in the future based on evolving requirements.

Case Filtering

image.png

After selecting a customer, the case table updates to reflect cases specific to that customer, ensuring users can focus on relevant incidents.
Customer Selection:
  • Dropdown Menu: Displays a list of available customers (e.g., SK Telecom, Samsung Electronics, KT&G, Ericsson, Coca Cola, General Electric, BMW).
  • Action: Click the "Select a customer" dropdown to choose a customer, filtering the case list to show only cases related to the selected customer.
Multi-Tenant Support:
  • Each customer is represented, indicating secure separation of data in the multi-tenant environment.
  • The associated assets for the selected customer are displayed.

image.png

The Select an Asset dropdown on the Case List screen allows users to filter cases by specific assets. It lists assets such as "Seoul IDC LW3007," "T-Store Pangyo LW2308-4G," and "Daejeon IDC LW7009." Users can select an asset and click "Selection Confirmed" to update the case list.

image.png

The Advanced Search feature on the Case List screen allows users to refine their case search with additional filters. Accessible via the "Advanced Search" button, it includes options to select a customer, asset, severity level (e.g., Critical, High), and enter a search keyword. Users can apply these filters by clicking the "Search" button to update the case list.
Back to top