Attack Surface InsightsAttack Surface Insights Release Notes

User Risk Trend Chart

To understand a user entity's history and identify trends in their level of risk, you can now view a line chart of a user entity's risk score over time.

You can view the user entity's risk score over a time frame you specify: the past seven days, two weeks, one month, two months, or three months.

You can also navigate directly to the Threat Center case or alert associated with the risk score for a given day.

Associated Open Threat Center Cases in User Entity Details

To start investigating a user entity from Attack Surface Insights, you can now view the number of open Threat Center cases whose detections are grouped by the user entity and created during the time frame selected in the User Risk Trend chart:

To navigate directly to those cases in the user entity details, click <#> open cases.

If there are no open cases in the time frame, the information doesn't appear.

Entity Deletion

To remove obsolete entities created due to parsing or enrichment issues, you can now delete entities.

Attack Surface Insights Entity Tags in Threat Center

You can now find Threat Center cases or alerts related to groups of entities.

When the detections of a case or alert are grouped by entity, the tags of that entity are automatically added to the tags of the case or alert. You can then use the tags to search for cases or alerts involving certain kinds of entities.

Entity tags are copied to the case or alert. If you remove a tag from the entity, the tag remains in the case or alert. If you remove a tag from the case or alert, it remains in the entity.

Default Search Enhancement

To ensure you get a blank slate to define your own search query, there is no default search query for user and device entities when you open Attack Surface Insights.

Introducing Attack Surface Insights

Welcome to Attack Surface Insights, the directory for organizational resources in your environment, also known as entities.

Attack Surface Insights is supported with a New-Scale Analytics or New-Scale Fusion license.

To get started with Attack Surface Insights, view the Attack Surface Insights documentation.