New close workflow

The New Close Workflow is used to close, resolve, assign, and provide report data for detections and entities.

Introduction

This article describes the New Close Workflow functionality. This capability is designed to streamline operations, ensure clarity in resolution of actions, and ultimately capture the outcomes which enables reporting on these outcomes.

The existing Operational Metrics report is disabled when the New Close Workflow is enabled. Vectra's Operational Overview report shows detail on New Close Workflow outcomes. Some tracking of outcomes is also available in the Executive Overview report.

When the New Close Workflow is enabled, new Close As options are available for detections and entities. These new options replace the former Filter just this detection and Mark as Fixed options. Entity assignments are NOT closed when using Close As at the entity level and assignments must be changed or deleted manually.

The Triage Best Practices article provides detailed guidance for triage actions and terminology. The New Close Workflow described in this article also determines how some aspects of triage function, because when enabled, there will no longer be an option to Mark as Fixed or Filter just this detection and detections will need to be closed as Benign, Remediated, or a Create Filter Rule action can be created to triage the detection, future detections, and other active detections that have not aged out in the system.

The Assignment Workflow FAQ provides guidance for using assignment at an entity level.

Enablement

All deployments now default to having the New Close Workflow enabled unless a customer has specifically disabled it.

To check the status in your UI, simply navigate to Configuration → SETUP → General Settings → New Close Workflow:

It is still possible to disable the New Close Workflow, but Vectra plans to fully remove the legacy workflow in a future update. Please contact Vectra to discuss if this will be problematic for your deployment.

How the New Close Workflow Functions?

Entity Assignment and Closure/Resolution

When working with entities (hosts and accounts) in Vectra AI products, you can assign the entity to an analyst. What happens inside the system is that all the active detections for that entity are assigned to the chosen analyst. Detections can then be closed or filtered/resolved at a detection level or at an entity level. When closing at the entity level, all assigned detections are also closed but the assignment, if present, remains until changed or deleted manually.

Filtering or Closing Individual Detections

Individual detections can be filtered or closed so that the detection will no longer impact the score for an entity. This can be done by individual detection or in bulk. Options again vary based on where you are in your Vectra UI and which close workflow you are using.

Via Individual Detection Pages:

New Close Workflow	Legacy Workflow

Via Bulk Actions From the Detections Page in Your UI:

New Close Workflow	Legacy Workflow

Closing or Resolving All Active Detections on an Entity

When using the New Close Workflow or when working with entity assignment and resolution in the legacy workflow, all active detections can be triaged easily at once at an entity level.

• When using Close As at an entity level, all active detections attributed to the entity will be closed (triaged) as either Benign or Remediated.

  • If the entity was assigned to an analyst, this does not close the assignment. If you wish for future detections to not be assigned to the same analyst, change or delete the assignment.
• When resolving an entity assignment using the legacy workflow, choosing any outcome will close the assignment, triage the individual detections, and close the assignment.

New Close Workflow	Legacy Workflow

Why Should Entity Assignments / Detections Be Closed?

The Executive Overview report provides some tracking of assignment and detection outcomes.

The Operational Overview report tracks things like:

• MTTA - Mean Time To Assignment
• MTTI - Mean Time To Investigate
• MTTR - Mean Time To Resolve

Using entity assignments and closing the detections assigned to an entity will drive the numbers used on the reports and help measure SOC team effectiveness in dealing with prioritized alerts from the system.