The Incident Reports tab of the Threat Detection screen provides the user with a list of each incident notification that the system has received for one of their Subscriptions.
1. Log in to the Cloud Core Services application
Refer to How do I Access Cloud Core Services?
2. Access the Threat Detection screen by either clicking the Threat Detection dashboard tile (or the left menu item)
Dashboard
The dashboard tile will indicate whether or not email addresses have been configured to received incident reports. If the tile indicates that there are zero email recipients configured, refer to How do I manage Threat Detection configuration for my Organization?
Left Menu
3. Click the “Incident Reports” tab
4. Core Services presents the Incident Reports history
The table includes a row for each incident report notification that the system has received. The following information is recorded for each incident report notification:
- Date: the date that the system received and processed the incident report.
- Subscription ID: the Azure Subscription that the incident report pertains to.
- File Name: the PDF file name of the incident report.
- Status:
- SUCCEEDED indicates that the report was successfully emailed
- FAILED indicates that an error took place.
- Message: for FAILED notifications a human-readable message will describe the problem.
- Email Address(es): the set of email addresses that were configured at the time when the incident report notification was processed.
