[Cyber Command] The risk business perspective has marked a Server as processed, but the number of processed events in the overview interface is still 0

Problem Description

A service has been marked as processed in the risk business perspective, but the number of processed events in the overview interface is still displayed as 0, as shown in the following figure:

978275d555461b847f.png (52.89 KB)

538495d55547aa19b1.png (32.04 KB)

Process——

[Disposal Center] – [Secure incident Perspective] Filter [All Processing Status], all Host or Server under a Secure incident are marked as processed, and the processed incident on the overview interface will be +1, as shown below:

384445d6b3d78783a9.png (87.23 KB)

40765d5a56ff86058.png (76.07 KB)

Root cause

The processed incident in the overview interface refer to the Secure incident perspective. If you mark a Server incident as processed in the [Risk Business Perspective], the number of processed events in the overview interface will not necessarily increase. Instead, the number will only be counted when all Host or Server under a Secure incident [Disposal Center] – [Secure incident Perspective] are marked as processed in [All Processing Status].

solution

In [Handling Center] – [Secure incident Perspective], filter [All Processing Status] under a Secure incident and all Host or Server the event have been processed. Only the processed items in the overview interface will be counted.

Original Link

https://support.sangfor.com.cn/cases/list?product_id=24&type=1&category_id=9773&isOpen=true