Enhanced Summary for Breach Intelligence

Enhanced Summary for Breach Intelligence offers cyber incident reporting with a new, detailed summary to provide you with clearer, more actionable insights. This enhanced summary will be available in both the portal view and the new shareable PDF report.

This report is designed to help security operations teams:

• begin their investigations
• deploy containment strategies
• and share relevant information with stakeholders and vendors

Where can I find Enhanced Summary?

• This feature is available for Continuous Monitoring and Cyber Insurance

Good to Know

• When specific metadata is not available for an event, the field will display as a null value in the portal and PDF report.
• If there is no enhanced summary data available for an event, the option to expand the summary will not be available in the portal.

Enhanced Summary Fields

• Actor: The specific individual, group, or organization suspected of being responsible for a cyber incident. In the case of cyber news, this may also reference the entity disclosing the event.
• APT (Advanced Persistent Threat): A high-capability adversary that uses sophisticated techniques to maintain a long-term, undetected presence on a network for specific strategic goals.
• CVE: A publicly known cybersecurity vulnerability in a specific software or hardware product.
• Malware: A group of related malicious software programs (e.g., "Jupyter") that share common code, delivery methods, or functional characteristics.
• Ransomware: A specific variant of malware designed to encrypt files or lock systems until a ransom is paid (e.g., "Warlock").
• Leaked Data: The specific categories (e.g., PII, credentials) and total volume of sensitive information that has been unauthorizedly exfiltrated or exposed.
• Activity Category: The primary motivation or objective of the actor regarding the stolen data, such as financial gain (selling), political espionage, or operational disruption
• Affected Products: The internal applications, software versions, or hardware interfaces identified as the primary targets or entry points during the incident.