Before you start
- You need Security read access.
- Acronis must be connected and its endpoints mapped to companies. Without Acronis, the EDR Incidents tab does not appear. See Enable the Acronis integration.
- Huntress incident reports are on the separate Huntress tab. See Read Huntress security items.
Find an incident
1
Open EDR Incidents
Open Security > EDR Incidents and check the company selector.
2
Search by host
Type in the Host column filter. It matches the host name or the host domain.
3
Filter the list
Use Company to pick companies, Severity to pick High, Medium, or Low, and State to pick Not Started, Investigating, or Closed. Click a column header to sort by it.
4
Read the row
Each row shows #, Host, Company, Severity, Category, State, Mitigation, and Detected. The table shows 20 incidents per page.
5
Open the details
Click a row, away from its checkbox and its three-dot menu, to open the side panel.
Understand the fields
- Severity is the severity Acronis reports. Category names the kind of detection.
- State tracks the investigation: Not Started, Investigating, or Closed.
- Mitigation is separate: Auto Mitigated, Mitigated, or Not Mitigated. A Closed incident can still be Not Mitigated, and a Mitigated incident can still be open.
- A badge can simplify a more specific Acronis value. Open the details panel to read the full Mitigation text.
Read incident details
1
Open the side panel
Click the incident row. The title reads Incident # followed by the incident number.
2
Read the badges and categories
The top of the panel shows the State and Mitigation badges and the Categories.
3
Read Host
Host lists Host Name, Domain, IP Address, Agent Version, and Company.
4
Read Incident Details
Incident Details lists Severity, Verdict, State, Mitigation, Detected, Created, and Updated. Fields without a value are left out.
5
Open Acronis if you need more
Click Open in Acronis Console to open the incident in Acronis in a new tab. This needs your own Acronis sign-in.
Troubleshooting
Frequently asked questions
Does Closed mean the incident is mitigated?
Does Closed mean the incident is mitigated?
No. State and Mitigation are separate. Read both.
Does opening the Acronis link give me access to Acronis?
Does opening the Acronis link give me access to Acronis?
No. You need your own Acronis access. Company users can ask their MSP to investigate.
Can I resolve an incident or start a scan here?
Can I resolve an incident or start a scan here?
No. Use Acronis for remediation.
I am a company user. How do I ask for an investigation?
I am a company user. How do I ask for an investigation?
Tell the Home AI Assistant the incident number, host, company, severity, and date, then confirm the request when prompted.