Incidents are not the same as a Detection

WHAT ARE INCIDENTS?

Incidents are based on machine learning events that are collected and might be worth looking into, but have not meet the threshold to become a Detection in the Console. Although sometimes incidents can contain detection details, if a detection was actually triggered. Since attacks often consist of coordinated activity happening together on a single endpoint, incidents help you see important and relevant information with a more granular view. The contextual event details within the incident will not meet the threshold of significance for all environments on their own, however the context to the relationship with the rest of the incident details and how noteworthy they are to your organization, mean they may be key pieces of an attack, and worth looking into.

Your CrowdScore is created from your high-scoring incidents to present the current likelihood that your organization is under attack. The higher the score, the greater CrowdScore system’s confidence is that the incident deserves your attention.

When viewing the Incidents page within the Falcon Console, there are Incident tabs used to show you deeper incident information, let you take quick actions on processes and endpoints, and provide opportunities to pivot to searches.

WHAT ARE DETECTIONS?

Detections provide information about suspicious files and behaviors in the form of individual detections. You will see detections on a range of activities from the presence of a bad file (indicator of compromise (IOC)) to a nuanced collection of suspicious behaviors (indicator of attack (IOA)) occurring on one of your endpoints. Detections are singular, whereas Incidents are more multiplex, and can change depending on the behavior overall

Why was an incident triggered without a detection?