# Report #### **Event Report** The Event Report menu can be found in the Report section of the left sidebar. ![image.png](https://book.weetizen.com/uploads/images/gallery/2025-04/scaled-1680-/fxHimage.png) #### **Event Report List** [![image.png](https://book.weetizen.com/uploads/images/gallery/2025-04/scaled-1680-/HSLimage.png)](https://book.weetizen.com/uploads/images/gallery/2025-04/HSLimage.png)

The **Event Report** menu in the SmartWAN Portal displays a list of generated reports for events.

Accessible under the "Report" section, it includes filters for selecting a customer, asset, and date range, a search bar for reports by name or ID, and an "Advanced Search" option.

#### **Event Report Details**

The **Event Report Detail Screen** in the SmartWAN Portal is displayed when a report is selected from the **Event Report** menu. It provides a comprehensive view of the report, organized into multiple sections accessible via tabs at the top of the screen.

**Report Sections (Tabs) Table**

Tab Number	Section Name	Description
I	Overview	Provides a summary of the report, including title, ID, reporter, date, and analysis period.
II	Statistics	Displays statistical data related to the case, such as event counts and asset details.
III	Analysis	Details the analysis of the case, including root cause and impact assessment.
IV	Remediation	Outlines the remediation steps taken to resolve the incident.
V	Conclusion	Summarizes the outcomes and conclusions of the case response.
VI	Recommendations	Offers recommendations to prevent similar cases in the future.

##### **I. OverView** [![image.png](https://book.weetizen.com/uploads/images/gallery/2025-04/scaled-1680-/ehvimage.png)](https://book.weetizen.com/uploads/images/gallery/2025-04/ehvimage.png) The **Event Report Detail Screen** under the "Overview" tab (I) includes the following items, each serving a specific purpose:

- **Report Title**: Indicates the main subject or focus of the report, providing a clear identifier for the incident or analysis. - **Report ID**: A unique identifier assigned to the report for tracking and reference purposes within the system. - **Reported By**: Identifies the user who generated the report, including their contact information for accountability and follow-up. - **Report Date**: Specifies the date and time when the report was finalized, helping to establish a timeline for the incident response. - **Analysis Period**: Defines the time range during which the incident was analyzed, providing context for the duration of the event and response efforts. - **Distribution Target**: Lists the individuals, teams, or roles to whom the report is distributed, ensuring relevant stakeholders are informed. - **Summary**: Offers a high-level overview of the incident, including key findings, the nature of the threat, and its impact, to provide a quick understanding of the situation. - **Related Elements**: Presents statistical data in visual form (e.g., pie charts) to show the distribution of events by severity and the types of assets affected, aiding in understanding the scope and impact of the incident.

##### **II. Statistics**

The **Statistics** tab (II) in the **Event Report Detail Screen** of the SmartWAN Portal provides statistical insights into the incident, helping users understand the severity, urgency, and distribution of related events.

[![image.png](https://book.weetizen.com/uploads/images/gallery/2025-04/scaled-1680-/Zfvimage.png)](https://book.weetizen.com/uploads/images/gallery/2025-04/Zfvimage.png)

This image displays a partial section of the complete report.

--- **Statistics Report Summary**

Section	Purpose	Key Details
Threat Case Classification	Prioritizes security cases based on severity and urgency.	- Severity: Measures threat danger (Low/High). - Urgency: Measures response time needed (Low/High). - Matrix: Combines both (e.g., High Severity + High Urgency = Critical).
Distribution of Related Events	Visualizes how related security events spread across time/systems.	- Tracks event frequency and patterns. - Aids in identifying attack scope and hotspots.
List of Related Events	Groups events with shared attributes to uncover attack sequences.	Grouping Criteria: - Common Indicators: Shared IPs, users, devices. - Time Correlation: Events in close proximity. - Attack Patterns: Matches MITRE ATT&CK tactics. - Behavior Analysis: Suspicious chains (e.g., file execution → external connection). - Threat Intelligence: Matches known IOCs.

--- **Threat Case Classification Matrix**

Severity \\ Urgency	Low Urgency	High Urgency
Low Severity	Minor threat; resolve later.	Less critical but needs prompt handling.
High Severity	Serious threat; no immediate action.	Critical; requires immediate response.

--- **Key Takeaways** 1. **Prioritization**: Clear severity/urgency tiers streamline incident response. 2. **Pattern Analysis**: Distribution and event grouping reveal attack trends. 3. **Correlation**: Multi-criteria linking (time, behavior, IOCs) enhances threat detection. ##### **III. Analysis** The Analysis tab (III) in the Event Report Detail Screen of the SmartWAN Portal provides in-depth **threat pattern analysis**, **response effectiveness, and correlations between threat factors.** [![image.png](https://book.weetizen.com/uploads/images/gallery/2025-04/scaled-1680-/btmimage.png)](https://book.weetizen.com/uploads/images/gallery/2025-04/btmimage.png)

This image displays a partial section of the complete report.

**Threat in Similar Case Occurrences and Responses**

Section	Purpose	Key Details
Threat in Similar Case Occurrences	Analyzes the frequency and severity of past security threats over a specified period.	- Tracks threat patterns (e.g., monthly trends). - Visualizes data to identify critical/high-risk periods.
Threat in Similar Case Responses	Evaluates the effectiveness of organizational responses to past threats.	- Assesses response strategies (e.g., speed, methods). - Identifies areas for improvement.

--- **Threat Factor Correlation Analysis**

Section	Purpose	Key Details
Threat Level Distribution of Related Factors	Maps the severity levels (Critical/High/Moderate/Low) of linked threat factors.	- Highlights high-risk elements (e.g., IPs, users). - Aids in prioritizing response actions.
Probability Distribution of Risk Levels	Quantifies the likelihood of each risk level occurring among correlated factors.	- Uses statistical analysis (e.g., "60% Moderate risk"). - Supports predictive threat assessment.

**Correlation Rules**: Time-based or entity-based logic is applied to detect complex attack patterns.

**Threat Scores**: Calculated based on severity, context, and threat intelligence to guide decision-making.

##### **IV. Remediation** Remediation tab (IV) in the Event Report Detail Screen of the SmartWAN Portal provides **threat mitigation actions**, including detection, containment, recovery, and preventive measures for resolved security cases. [![image.png](https://book.weetizen.com/uploads/images/gallery/2025-04/scaled-1680-/vkuimage.png)](https://book.weetizen.com/uploads/images/gallery/2025-04/vkuimage.png) **Remediation Report Section**

Section	Purpose	Explanation
Detection of Malicious Traffic	Identify and analyze suspicious network activities	Uses SIEM/IDS to detect anomalies like port scanning or unusual connections.
Multiple Failed Login Attempts	Prevent brute-force attacks and unauthorized access	Monitors repeated login failures, locks accounts, blocks suspicious IPs, and enforces stronger authentication (e.g., MFA).
Detection of Abnormal File Access	Protect sensitive data from unauthorized access or exfiltration	Alerts on unusual file access patterns (e.g., mass downloads). Includes user verification and role-based access reviews.
Execution of Unauthorized Applications	Block potentially harmful software execution	Detects unapproved apps (e.g., TeamViewer), terminates processes, and enforces app control policies (e.g., allowlisting).

##### **V. Conclusion** The Conclusion tab (V) in the Event Report Detail Screen of the SmartWAN Portal provides a synthesis of key findings about cases and indicators of attack. [![image.png](https://book.weetizen.com/uploads/images/gallery/2025-04/scaled-1680-/SjTimage.png)](https://book.weetizen.com/uploads/images/gallery/2025-04/SjTimage.png) **Section Overview**

Section	Purpose	Explanation
Conclusion	To synthesize key findings about cases.	Provides a high-level analysis of similarities in attack methods (e.g., code reuse, C2 communication) to link incidents to known threat actors or campaigns. Helps analysts identify operational patterns.
Indicator of Attack	To map observed tactics to standardized frameworks for threat categorization and response planning.	Aligns attack techniques (e.g., spearphishing, steganography) with MITRE ATT&CK tactics (e.g., T1566.001). Enables defenders to prioritize mitigations based on proven threat models.

##### **VI. Recommendations**

The **Recommendations** tab (VI) is the final section of the **Event Report Detail Screen** in the SmartWAN Portal.

This tab provides actionable suggestions and best practices to prevent similar incidents in the future. It focuses on improving security measures, addressing vulnerabilities, and enhancing response strategies based on the incident analysis.

[![image.png](https://book.weetizen.com/uploads/images/gallery/2025-04/scaled-1680-/VQBimage.png)](https://book.weetizen.com/uploads/images/gallery/2025-04/VQBimage.png)

A sample PDF file of the Event Report described in this guide is available for download. You can access the full report, including all sections (Overview, Statistics, Analysis, Remediation, Conclusion, and Recommendations).

Sample PDF download: [ANRN-00936.pdf](https://appexnetworksadmin.sharepoint.com/:b:/s/AppExKR/EYg4U4vaESBJhCNcILFycwYBMOBfQ211Z2u7zPdEeMeHxQ?e=URy1w2) (APPEX Networks user only)

Section	Purpose	Key Details
Threat Case Classification	Prioritizes security cases based on severity and urgency.	- Severity: Measures threat danger (Low/High). - Urgency: Measures response time needed (Low/High). - Matrix: Combines both (e.g., High Severity + High Urgency = Critical).
Distribution of Related Events	Visualizes how related security events spread across time/systems.	- Tracks event frequency and patterns. - Aids in identifying attack scope and hotspots.
List of Related Events	Groups events with shared attributes to uncover attack sequences.	Grouping Criteria: - Common Indicators: Shared IPs, users, devices. - Time Correlation: Events in close proximity. - Attack Patterns: Matches MITRE ATT&CK tactics. - Behavior Analysis: Suspicious chains (e.g., file execution → external connection). - Threat Intelligence: Matches known IOCs.

Severity \\ Urgency	Low Urgency	High Urgency
Low Severity	Minor threat; resolve later.	Less critical but needs prompt handling.
High Severity	Serious threat; no immediate action.	Critical; requires immediate response.

Section	Purpose	Key Details
Threat in Similar Case Occurrences	Analyzes the frequency and severity of past security threats over a specified period.	- Tracks threat patterns (e.g., monthly trends). - Visualizes data to identify critical/high-risk periods.
Threat in Similar Case Responses	Evaluates the effectiveness of organizational responses to past threats.	- Assesses response strategies (e.g., speed, methods). - Identifies areas for improvement.

Section	Purpose	Key Details
Threat Level Distribution of Related Factors	Maps the severity levels (Critical/High/Moderate/Low) of linked threat factors.	- Highlights high-risk elements (e.g., IPs, users). - Aids in prioritizing response actions.
Probability Distribution of Risk Levels	Quantifies the likelihood of each risk level occurring among correlated factors.	- Uses statistical analysis (e.g., "60% Moderate risk"). - Supports predictive threat assessment.

Section	Purpose	Explanation
Conclusion	To synthesize key findings about cases.	Provides a high-level analysis of similarities in attack methods (e.g., code reuse, C2 communication) to link incidents to known threat actors or campaigns. Helps analysts identify operational patterns.
Indicator of Attack	To map observed tactics to standardized frameworks for threat categorization and response planning.	Aligns attack techniques (e.g., spearphishing, steganography) with MITRE ATT&CK tactics (e.g., T1566.001). Enables defenders to prioritize mitigations based on proven threat models.