Understand the Event Lifecycle

Events are indicators of potentially threatening activity generated by Red Canary for the purpose of enabling investigations by the Red Canary Cyber Incident Response Team (CIRT). Events are similar to the alerts produced by other security products. To prevent false positives, Red Canary investigates all events.

Events page

From the navigation menu, Click Events to see a list of analyzed potentially threatening events in your organization and the top observed tactics.

Click into any analyzed event to view detailed information about the behaviors and activity observed in the event and what Red Canary found. You can also view events By Observed Tactic or By Observed Technique (as defined in the MITRE ATT&CK framework) during a specified timeframe and download a CSV file for further analysis.

How are events identified?

Events are the result of applying various types of behavioral analytics and intelligence to the large volume of endpoint telemetry Red Canary analyzes from your environment.

Before an event is generated, Red Canary determines whether the behavior has already been flagged as non-threatening. In these cases, Red Canary suppresses the event. Suppression criteria are the product of past investigations performed by Red Canary's CIRT and are used to prevent investigations of the same behavior. The majority of activity is eliminated via suppression before it results in an event. (Learn more about suppression on the Red Canary blog.)

Events can be created under the following circumstances:

• Indicators of Compromise (IOCs) identified by Red Canary or a third party are applied to telemetry.

• Detectors inspect telemetry to identify adversary behaviors, or attributes of processes or software that are suspicious.

• Retrospective analysis identifies past occurrences of newly identified indicators or behaviors.

• The Red Canary CIRT hunting within or across environments during the course of an investigation, or while testing new threat hypotheses.

• Red Canary processing an alert from one of your external alert sources.

What does Red Canary do with events?

Red Canary or Red Canary's CIRT investigates and dispositions events.

Some events are handled automatically, allowing Red Canary to quickly identify and communicate high-frequency or high-impact events to you. Common uses of automated event processing include the identification of unwanted software, certain known malware behaviors, and rapid response when Red Canary is introduced to a new environment experiencing an incident.

How are events classified?

Analyzed events are classified in one of the following ways:

How long are events retained?

Events associated with a confirmed threat are retained indefinitely. Other events are retained for one year.