> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/incidents.md). # Incidents The incidents overview provides an overview of all SIEM incidents detected by your configured [workflows](/docs/manual/english/platform-usage/siem/workflows.md) or through incident detection enabled in [streams](/docs/manual/english/platform-usage/siem/advanced-settings/streams.md) or [stream catalogs](/docs/manual/english/platform-usage/siem/stream-catalogs.md). {% hint style="info" %} SIEM incidents are stored for 90 days by default. To retain them for longer, you can extend the log retention periods accordingly. {% endhint %} {% hint style="success" icon="lightbulb" %} For more information on how to change the retention periods for Enginsight log entries, see our Knowledge Base: [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs) {% endhint %} *** Navigate to **SIEM** → **Incidents** to show a list of all triggered SIEM incidents. If no incident has been triggered yet, this view is empty.

The [incident overview](#left-side-incidents-overview) provides information such as: * which stream triggered an incident. * which host is affected by an incident. * the time period during which an incidents occurred. * the total number of incidents over time and by stream, workflow, severity, host, and stream catalog. You can also define the [start and end time](#define-start-and-end-time) for the displayed data and open the [detail view of an incident](#incidents-detail-view). *** ## Navigation Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly. Click the **Refresh** icon above the list to update all list items. Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages. ### Defining Start and End Time Click **Start Time** or **End Time** in the upper-right corner to define the start or end of the period to be analyzed. The date picker opens. {% tabs %} {% tab title="Relative Time Period" %} Define a **Relative Time Period** manually. You can also select a relative time range from one of the available **Templates**.

Click the field with the default setting **Days Ago** to expand a list of all available time ranges. Select a time range. In the number field, enter the number of seconds, minutes, hours, days, or weeks you want to show. The default value is **1**. Click **Apply** to confirm your settings. {% endtab %} {% tab title="Absolute Time Period" %} Select a date from the calendar view.

Optionally, click **Time** to set an exact time in the 24-hour format using the clock face. First, select an hour. The clock face then switches to the minute view. Select the required minutes. Click **Apply** to confirm your settings. {% endtab %} {% endtabs %} Click **Reset** in the upper-right corner to reset the settings for the selected time range. ### Filtering the List Click the **Filter** icon above the list to filter the list by predefined parameters.

Available Filters

Parameter	Type	Description
Severity	String	Filter for all incidents with a specific severity, or exclude them from the results. All available severity levels are shown.
Workflow	String	Filter for all incidents detected by a specific workflow, or exclude them from the results. All available workflows are shown.

### Sorting List Items Click the **Sort** icon next to a column name in the table header to sort by that column in ascending or descending order . Click the sort icon above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority. ### Further Actions for List Elements Select the checkbox next to a list item to select the corresponding item. Alternatively, select the checkbox in the table header to select all list items. The number of selected list items is now shown next to the search field. The **Acknowledge** button also appears in the upper-right corner. With this option, you can manually remove an incident from the [incident overview](#left-side-incident-overview). Click **Acknowledge** to open a new window where you can optionally enter a descriptive comment.

Click **Apply** to remove the incident from the incident overview and save the comment. *** ## Left Side: Incident Timeline The incident timeline displays a bar chart that shows the number of all incidents that occurred during the selected time period, grouped by severity. {% hint style="info" %} Each bar represents a point in time at which incidents were detected. {% endhint %}

Click the severity values **Informational**, **Low**, **Medium**, **High**, or **Critical** to show or hide incidents in the corresponding categories. Hover over a bar in the chart to show the exact time of the measurement and the number of incidents in each category. *** ## Left Side: Incident Overview The incident overview is structured as a table.

The following information is shown:

Column	Description
Severity	Shows the custom severity level of the incident. It is based on the settings of the workflow or stream that triggered the incident. The following severity levels can be shown: Critical: The incident has very high criticality. High: The incident has high criticality. Medium: The incident has medium criticality. Low: The incident has low criticality. Informational: The incident is for informational purposes only.
Source	Shows the name of the stream that triggered the incident and the stream catalog that contains the stream. Click the name of a stream to navigate to the corresponding incident detail view.
Incident Started	Shows the date and time when the incident conditions were met for the first time.
Incident Ended	Shows the date and time when the incident conditions were met for the last time.
Hosts	Shows the name of the host affected by the incident, if available.
Created At	Shows the date and time when the incident appeared in the incident overview.
Go to Playbook Flow	Click the Go to Playbook Flow button to open the flow detail view, where you can review the playbook run that triggered the incident.

*** ## Right Side: Incident Charts On the right side of the view, you can find various pie charts that break down the number of SIEM incidents for the selected time period by stream, workflow, severity, host, and stream catalog.

Click a value in one of the pie charts to filter the [incident timeline](#left-side-incidents-timeline), the [incident overview](#left-side-incidents-overview), and all [incident charts](#right-side-incidents-charts) accordingly. *** ## Incident: Detail View Click an entry in the **Source** column to navigate to the corresponding [incident details view](/docs/manual/english/platform-usage/siem/incidents/incidents-detail-view.md). *** ## Further Resources **Knowledge Base** * [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs) ***