MDR Closed Incidents

The MDR Closed Incidents page gives you a permanent, on-demand record of every incident your Managed Detection & Response (MDR) team has resolved on your behalf. Use it to review what happened, understand how each incident was handled, and to help prepare for conversations with your Cybersecurity Advisor (CA).

To reach the MDR Closed Incidents page, go to Response & Remediation > MDR Closed Incidents.

You must have an active MDR subscription to access MDR Closed Incidents.

Only closed incidents appear here. Active incidents are not included.

When you open the MDR Closed Incidents page, you see a summary of your incident history along with key performance indicators (KPIs) at the top of the page.

The KPI cards provide a snapshot of your closed incident activity, including:

• Total incidents - total count of closed incidents with a 30-day trend indicator.
• Critical, High, Medium, and Low - incident counts by severity, each showing the percentage change compared to the previous period.

Below the KPI cards, a table lists all of your closed incidents. You can search, filter, and export the table to find specific incidents or share data with your team.

View incident details

Select any incident in the table to open its detail view.

Overview

The Overview tab is your starting point for understanding what happened during an incident. It includes:

• Incident summary - a description of the incident and its outcome.
• Timeline - a visual, chronological view of key events in the incident lifecycle, including when investigations opened and closed, when alerts fired, and when Requests for Information (RFIs) were raised. Use the left and right arrows to scroll through the timeline.
• Recommendation Actions - suggested strategic and tactical actions to strengthen your security posture and reduce the risk of similar incidents.
• Source Investigation - a list of the investigations linked to this incident, including open and close events for each. Select an investigation to go directly to the SIEM Investigations  page.
• Related resources - select Open in Customer Portal in the top right of the page to go to the customer portal and view related threads for this incident.

Evidence

Evidence gives an overview of how the service reached its conclusion about an incident. The information comes from the Evidence text input in ReARC Incidents.

Evidence can include these details:

• Overview
• Timestamp
• Impacted asset or account
• Threat status
• Response actions taken
• Investigation findings
• Alert and user details

Alerts

The Alerts tab shows every alert that occurred during the incident. Review this tab to understand which detections contributed to the incident and how the MDR team triaged them.

Create a report

You can create a report for a group of incidents.

To create a report for a group of incidents:

1. Go to Response & Remediation > MDR Closed Incidents.
2. Select Create Report.
3. Enter a name and description for the report.
4. Select the report format.
5. Set the date range.
6. Optionally, schedule your report and choose a delivery frequency and recipients. You can send reports to yourself, your CA, or both.
7. Select Create.

You can also create a report for a specific incident from its detail view.

To create a report for a specific incident:

1. Open the incident you want to report on.
2. Select Create Report.
3. Enter a name and description for the report.
4. Select the report format.
5. Set the date range.
6. Schedule your report and choose a delivery frequency and recipients. You can send reports to yourself, your CA, or both.
7. Select Create.

Depending on your settings, the report generates immediately or on the date and time scheduled.