Synchronize Alert States and Comments

Red Canary syncs updated states and comments from its platform to your connected security tools. As alerts are processed and validated within Red Canary, their statuses and comments are pushed to your security platforms. This synchronization ensures your tools are kept updated, saving you time by avoiding the need to review alerts already handled by Red Canary.

Supported Alert Sources for State and Comment Sync

Red Canary can add comments to alerts and update their states for several supported alert sources. This is known as “state and comment synchronization.” We support state and comment synchronization for alert sources listed in the table below.

Note

* To configure syncing between Red Canary and these Microsoft sources, you’ll need to set up our Microsoft Graph integration, which controls alert ingestion into Red Canary.

** Only Sentinel and SentinelOne Singularity support notes to be added as comments in Red Canary.

Enable Comment Sync

You can instruct the Red Canary platform to add comments to alerts in the source platform during the process of alert validation.

To enable alert commenting for supported alert source platforms:

1. From your Red Canary homepage, click Integrations.

2. Scroll down and click an alert source.

3. Scroll down to the substep “Actions in the Source Platform.”
   

4. Under the Add comments to alerts in… section, check the desired options described in the table below.

   Option	Description
   As Red Canary validates the alert	Enabled by default. If enabled, Red Canary adds comments to the alert in the external alert source as the alert is investigated and resolved.
   When Red Canary determines the alert is not a strong investigative lead	Enabled by default. If enabled, Red Canary adds a comment to the alert in the external alert source that the alert is not a strong investigative lead. Learn more about Red Canary’s approach to security data.

5. Click Save.

Enable State Sync

You can instruct the Red Canary platform to automatically resolve alerts in the source platform when alert validation is completed by Red Canary.

To enable state synchronization for supported alert source platforms:

1. From your Red Canary homepage, click Integrations.

2. Scroll down and click an alert source.

3. Scroll down to the substep “Actions in the Source Platform.”
   

4. Under the Close alerts in… section, check the desired options described in the table below.

   Option	Description
   When Red Canary validates the alert as non-threatening	Enabled by default. If enabled, Red Canary resolves the alert in the external alert source if the state is “Not a Threat.”
   When Red Canary validates the alert as suspicious	Enabled by default. If enabled, Red Canary resolves the alert in the external alert source if the state is “Suspicious,” “Highly Suspicious,” or “Threat” but no threat has been published.
   When Red Canary publishes a threat involving the alert	Enabled by default. If enabled, Red Canary resolves the alert in the external alert source as “True Positive” if the state is “Threat” and a threat has been published.

5. Click Save.

FAQ

This alert has been validated by Red Canary and deemed a false positive because all
of the reviewed activity was deemed to be non-threatening.