Classification:

attack

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when ExtraHop raises a security risk event.

Strategy

Trigger notifications for security risk events detected by ExtraHop.

Triage and Response

1. Review the log detected with title: {{@title}} and with risk score: {{@risk_score}}.
2. Determine the potential impact and legitimacy of the event. If the activity is deemed benign, log the event for future reference.