Alerts and Incidents
Alerts
Alerts are warnings generated to notify users when any significant events occur. They fire incidents that enable you to execute appropriate actions. Any valid search query can trigger an alert to generate incidents.
You can create an alert rule and select a mechanism to notify you of the incident. Logpoint can notify you via Email, Syslog, SNMP, HTTP, or SSH. You have the flexibility to design an alert mechanism based on your requirements.
The Alert Rules section in LPSM allows you to set up, manage, and perform actions on the Alert Rules on behalf of the Fabric-enabled Logpoints connected to its pools.
Version compatibility of the alert rules:
Fabric-enabled Logpoint
Compatible Fabric-enabled Logpoint Versions
6.11.x
6.11.x
6.12.x
6.12.x to 7.1.0
7.0.x
6.12.x to 7.1.0
7.1.0
6.12.x to 7.1.0
7.1.1, 7.1.2, 7.1.3
7.1.1, 7.1.2, 7.1.3
7.2.x
7.2.x
7.3.0
7.3.0
Select Page View
You can view the alert rules in two ways:
Tabular view
Coverage view
Select a Page View
Go to
Settings >> Logpoint Configuration >> Alert Rules.
Select a view from the drop-down.
Select a Pool, a Machine, and a Logpoint User.
Click Coverage View/Tabular View.
Tabular View
Select Tabular View to display additional columns that list the Log Source, Attack Category, and Attack Tag of the alert rules. You can also see whether the alert rule is active or inactive in the Name column.
Coverage View
Select Coverage view to view the categorization of the alert rules based on various attack categories and attack tags associated with the attack tactics, attack techniques and, attack sub-techniques of the MITRE attack framework. The attack categories are displayed as column headers with the respective attack tags listed under. You can further drill down the attack tags.
You can click the attack tags to view the list of associated alerts rules. The alert rules are listed as similar to the tabular view.
Click the Help (
) icon on the top of the dialog box to view the description of the attack tag associated with the attack techniques and sub-techniques of the MITRE attack framework.
View Actions
The tabular/coverage view consists of an action bar allowing you to perform the following actions:
Pool
Shows the pool name that you have selected for the view. You can click the pool name to open the Select Pool, Machine and User pop-up where you can make the necessary changes.
Machine
Shows the name of the machine that you have selected for the view. You can click the machine name to open the Select Pool, Machine and User pop-up where you can make the necessary changes.
User
Shows the name of the user that you have selected for the view. You can click the user name to open the Select Pool, Machine and User pop-up where you can make the necessary changes.
Close view
Allows you to close the tabular/coverage view and return to the My Alert Rules page.
Add
Allows you to create a new alert rule using the alert creation wizard. Go to Creating an Alert Rule for more details.
Select Log Source
Allows you to filter the alert rules according to the log sources using the drop-down. The drop-down is only available for tabular view.
Filter Active Rules
Allows you to view only the active alert rules by selecting the checkbox. This checkbox is only available for tabular view.
More
The More drop-down near the top-right corner of the tabular view page lists additional actions.
The Activate Selected Alert Rules option lets you activate multiple alert rules at once.
The Deactivate Selected Alert Rules option lets you deactivate multiple alert rules at once.
Create Alert Rules
Create Alert Rules
Go to
Settings >> Logpoint Configuration >> Alert Rules.Click Add.
Select Pool, Machine, and Logpoint user in the Select Logpoint field where you want to create the Alert Rule.
Click Next.
Enter the Name of the alert.
Enter the Query for which you want the alert to trigger an incident. You can either manually enter a search query or pick a query from the Advanced Query Picker using the Select option.
Select the Repos that you want the alert rule to monitor for the matching alert condition.
In the Limit field, enter the maximum number of logs to retrieve using the entered Query.
Enter a Description.
Enter a Time-range of the alert.
Select Define Search Interval to apply a time interval to the search.
Enter the Search Interval in minutes. For example, if you set the search interval to two, Logpoint performs the search every two minutes. If you have used a pattern finding query in the Query field, the search is not performed in the specified Search Interval even if you select the Enable Search Interval checkbox as Search Intervals do not work with pattern finding.
Enable Delay Alert to define the delay threshold.
Enter the Delay Threshold in minutes. Logpoint waits until the delay threshold has passed before processing the logs, to ensure that all relevant logs are collected before generating the incidents.
Check Flush On Trigger if you want the next alert to be triggered only by a new set of events.
Select Alert Throttling to ensure that multiple alerts are not created for the same set of values for a specified time.
Enter the Field and the time in Minutes. Once an alert is triggered for a value of the particular Field, it does not trigger another alert for the same value specified in Minutes.
Click Next.
Select the Attack Tag from the drop-down. You can select multiple tags to categorize the alert.
Attack Category is selected based on the associated Attack Tags selected.
To categorize the alert rule, use both Field and Value to add metadata to the alert rule.
You can use letters, numbers, underscores (_), or a combination. Always start with a letter.
You can add as many metadata rows as you like. Click ADD NEW VALUE.
You cannott use the same Field name for two different values.
You cannot use Logpoint Jinja placeholders as categorization metadata. Go to Logpoint Reserved Jinja Placeholders to learn more.
Select Log Sources from the drop-down or enter new log sources associated with the alert rule. New log sources are also updated in the drop-down after submission.
Click Next.
Select the Condition, Risk, and Risk Calculating Function from the drop-downs. Based on the Risk level and Risk Calculation Function, Logpoint calculates the Risk Value of the alerts and incidents they generated. If the search result of the query contains the device_ip, the Risk Calculation Function takes the Risk Value of the devices and Risk level of the alert as arguments. For example: If the Risk level of an alert is Medium, Risk Calculation Function is Maximum, and the Risk Value of its associated device(s) is Critical, the Risk Value of the generated alert and incident is: Maximum(Risk level, Risk value of device(s)). That means the Risk value of the incident is Critical. The risk value of a device is calculated from the values of Confidentiality, Availability, and Integrity. Whereas for search queries with pipeline commands or without device_ip in the search results, the Risk Value of the alert and its generated incident(s) is equal to the Risk level of the alert.
Click Next. If required, you can assign an Alert Rule to an individual Logpoint user by selecting none of the Incident User Groups in the Manageable by tree node structure. For more information on Incident User Groups, refer to the Incident User Groups in Logpoint.
Select a user from the Assigned to drop-down. You need to assign the Alert rule to a user or user group. To select an individual user, select them in Assigned to. You can assign an Alert Rule to yourself by deselecting all of the Incident User Groups in Manageable by.
To assign the alert rule to a group, select the group in Manageable by. Users selected in both the Assigned to and Manageable by section can re-assign, comment on and view the data of the generated incident. However, only the Assigned to user can resolve it.
If you do not belong to any of the Incident User Groups, the Assigned to and Manageable by are hidden and in LPSM you get the following.
LPSM allows you to view the details of the incidents triggering the alert in a specific format. Enable Apply Jinja template and enter the template in the Template syntax field.
If the Data Privacy Module is enabled in the system, the Data Privacy Request window will appear. Check the Alert using original data option if you want the fields in the alert to be decrypted, else, the alert will be generated with encrypted values.
Click Finish. If you have checked the Alert using original data option, you will be notified with a confirmation message. Click Yes to create a data privacy request for the alert. The alert created hereby will be deactivated until the data privacy request is granted.
After completing the configuration, LPSM shows you a notification dialog box asking whether you want to configure the notifications for the rule. Click Yes. Once the alert is created, you can view it under My Rules. The alert is also created in the Fabric-enabled Logpoint.
You can also configure or change it later by clicking the Notification icon from the Actions column of the alert rule.
Now, whenever a search query meets all the alerting criteria, the alert is triggered, and it generates the corresponding incident. To view the incident, click the Incident tab.
Set Up Alert Notifications
After creating an alert rule on behalf of a Fabric-enabled Logpoint, you can set up the following notifications for the rule.
Email notification
SMS notification
Syslog notification
SNMP notification
HTTP notification
SSH notification
The message and command fields of the SMTP and SSH notifications support Jinja2 syntax. The message field of the Syslog notification supports Jinja syntax. For more information on how Jinja and Jinja2 syntaxes are implemented in the SMTP, SSH, and Syslog services, go to Setting Up Alert Notifications in Logpoint Alerts and Incidents.
In LPSM v2.2.0 and later, you can
Use the {{lpsm_search_link}} Jinja command to display the link to search for the logs that triggered the alert.
In Fabric-enabled Logpoint, the link redirects you to the LPSM search page.
In standard Logpoint, it redirects you to the Logpoint search page.
To use this Jinja command, Server Alias in
System Settings >> Generalmust be selected and a valid value specified. be empty and specified.For more information on supported Jinja syntax for alert notification setup, go to Logpoint Reserved Jinja Placeholders in Logpoint Alerts and Incidents.
Configure Email Notification
Go to
Settings >> Logpoint Configuration >> Alert Rules.Click the Setup Notification icon from the Actions column of the alert rule.
Select Email Notification and enable Notify via email.
In the Notification Trigger section:
Select Automatic to send a notification every time the alert rule is triggered.
Select Manual to manually send the notification from the Generated Incidents.
Enter valid email addresses under Emails.
Enter a Subject. Logpoint supports the following Jinja commands for the alert rules
{{alert_name}}{{detection_timestamp}}{{risk_level}}{rows}}{{rows_count}}
You can write them in a query as: Logs from {{rows.col_type}} on date {{rows.col_ts|datetime}}.
Select Toggle Simple View to enable or disable the advanced text editor.
Select Disable Search Link to remove the search link in the email. The search link redirects to the search page of the LPSM machine from which the email notification is configured.
Enter a Message.
Set the Threshold.
Select Enable Logo if you want to include the Logpoint logo in the email notification.
Browse for the image in the JPG/JPEG format if you want to provide a custom logo. The maximum dimension for the custom logo is 600*400.
Click Save.
Configure SMS Notification
Before configuring SMS notification, the SMSC server must be accessible from Logpoint.
Go to
Settings >> Logpoint Configuration >> Alert Rules.Click the Setup Notification (
) icon from the Actions.Select SMS Notification and enable Notify via SMS.
In Notification Trigger:
Select Automatic to send an SMS notification every time the alert rule is triggered.
Select Manual to manually send the SMS notification from the Generated Incidents.
Enter SMSC Server/Port. the SMSC server supports both hostname and IP address.
Enter Username, Password, and Sender ID of the server.
In Receivers, enter the phone numbers including the country code.
In Body, enter a template in Jinja format for the SMS.
Set the Threshold time to trigger the SMS notification after enabling it.
Click Save.
Configure Syslog Notification
Go to
Settings >> Logpoint Configuration >> Alert Rules.Click the Setup Notification icon from the Actions column of the alert rule.
Select Syslog Notification and enable Notify via Syslog.
In the Notification Trigger section:
Select Automatic to send a notification every time the alert rule is triggered.
Select Manual to manually send the notification from the Generated Incidents.
Enter the IP Address and the Port number for the syslog receiver in the Server/Port textboxes.
Select the level of Severity and Facility from the drop-downs.
Enter a Message that gives the information about the event. You can use the Jinja template to construct a message that extracts specific information about the event.
Set the Threshold.
Choose either the UDP or the TCP protocol to send the Syslog Notification.
Select the Send each new line as separate syslog notification checkbox to generate one syslog message for each log message in the search results. If you do not select it, all the messages within the chosen time range of the incident are compressed into one syslog message in the search results.
Configure SNMP Notification
Go to
Settings >> Logpoint Configuration >> Alert Rules.Click the Setup Notification icon from the Actions column of the alert rule.
Select SNMP Notification and enable Notify via SNMP Traps.
In the Notification Trigger section:
Select Automatic to send a notification every time the alert rule is triggered.
Select Manual to manually send the notification from the Generated Incidents.
Enter the trap receiver’s IP address and the Port number.
Enter a valid SNMP trap or Enterprise specific OID (Object Identifier) in the dotted decimal format. Make sure to not use the OID with a leading dot.
Select either the SNMPv2c version or the SNMPv3 version according to the security level you require.
The notification settings change according to the version you pick.
For SNMPv2c configuration
Enter the name of the Agent that sends the SNMP trap.
Enter a passphrase in the Community String. The passphrase should be recognizable by the manager.
Enter the OID’s corresponding value in the Message.
For SNMPv3c configuration
Enter the Username.
Enter the Authorization Key and Private Key.
At the Message tab, enter the OID’s corresponding value.
Set the Threshold.
Click Save.
Configure HTTP Notification
Go to
Settings >> Logpoint Configuration >> Alert Rules.Click the Setup Notification icon from the Actions column for the alert rule.
Select HTTP Notification and enable Notify via HTTP/S.
In Notification Trigger:
Select Automatic to send a notification every time the alert rule is triggered.
Select Manual to send the notification from the Generated Incidents manually.
In Protocol:
Select HTTP to send a notification using HTTP protocol.
Select HTTPS to send a notification using a more secure HTTPS protocol.
Enter either a valid IP address or domain name in the Base URL field.
Select a Request Type from the drop-down.
Enter a Query String. Logpoint supports the following Jinja commands for the alert rules:
{{alert_name}}{{detection_timestamp}}{{risk_level}}{{rows}}{{rows_count}}
You can write them in a query as:
user='admin'&count={{rows_count}}.Select an authentication Header type.
If you select Basic Auth, enter the required Key and Password.
If you choose API Token, enter the required Key and Value.
If you select Bearer Token, enter the required Key.
Enter a template for the Body of the HTTP notification in the Jinja format.
Set the Threshold. Threshold is a time after which next HTTP/S notification can be triggered.
Click Save.
Configure SSH Notification
Go to
Settings >> Logpoint Configuration >> Alert Rules.Click the Setup Notification icon from the Actions column of the alert rule.
Select SSH Notification and enable Notify via SSH.
In the Notification Trigger section:
Select Automatic to send a notification every time the alert rule is triggered.
Select Manual to manually send the notification from the Generated Incidents.
Enter a Server address and a Port number.
Enter a Username for the user in the destination server.
Enter a Command you want to execute when the alert rule is fired. Make sure that the command is a valid bash command and is executable.
Choose the required mode of Authentication: Password or SSH Certificate.
If you choose Password, enter a passkey in the Password tab.
If you choose SSH Certificate, select the Certificate type: System Certificate or User Certificate. The SSH Certificate key is automatically generated. You must add the key to the authorized keys at ~/.ssh/authorized_keys in your system.
If you choose System Certificate, LPSM uses system-specific certificate for authentication.
If you choose User Certificate, LPSM uses individual user-specific certificate for authentication.
Please note the password or the SSH certificate key, as it is required later for user-validation.
Set the Threshold.
Click Finish.
Manage Alert Rules
After you create an alert rule and configure notifications, you can take additional actions on the generated alerts.
Push Alert Rules
Go to
Settings >> Logpoint Configuration >> Alert Rules.Select the alert rules and click Push.
The Push Alert Rules pop-up menu appears.
Select the Pool, Logpoint, or User where you want to push the selected alert rules.
Click Push.
Push History
You can click the Push History (
) button to check the push history.
The Push History page lists the Push Summary, Status, Date, and Actions of all push attempts.
Click the Retry (
) icon from the Actions column to retry the failed push attempt.
Click the Details (
) icon from the Actions column to open the Push Detail page.
For failed push attempts:
Click the Retry (
) icon from the Actions column to retry individual failed push attempts.Click the Details (
) icon from the Actions column to view the error details about failed push attempts.
Export Alert Rules
Go to
Settings >> Logpoint Configuration >> Alert Rules.Select the alert rules and click Export.
Select the export format for the alert rules.
Edit an Alert Rule
Go to
Settings >> Logpoint Configuration >> Alert Rules.Click the Name of the alert rule.
Update the information.
Click Submit.
Edit Notification Configuration for Multiple Alerts
Go to
Settings >> Logpoint Configuration >> Alert Rules.Select the alert rules for which you want to setup notifications.
Click the More drop-down.
Select Setup Notifications of Selected Alert Rules.
Configure the notifications and click Save.
Activate Alert Rules
Go to
Settings >> Logpoint Configuration >> Alert Rules.Click the Activate alert rule (
) icon from the Actions column for the alert rule.To activate multiple Alert Rules, select the concerned rules. Click the More drop-down and select Activate Selected Alert Rules.
To activate all the Alert Rules, click the More drop-down and select Activate All Alert Rules.
Clone Alert Rules
Go to
Settings >> Logpoint Configuration >> Alert Rules.Click the Clone (
) icon from the Actions column for the alert rule.
Clone Alert Rules
Select the Logpoint user from the drop-down. The Pool and the Machine cannot be changed.
Enter a new Name for the cloned alert rule.
Check the Replace Existing? checkbox to replace an existing alert rule with the same name.
Click Clone.
Delete Alert Rules
Go to
Settings >> Logpoint Configuration >> Alert Rules.Click the Delete (
) icon under the Actions column for the concerned alert rule.To delete multiple alert rules, select the concerned rules. Click the More drop-down and choose Delete Selected Alert Rules.
To delete all the alert rules, click the More drop-down and choose Delete All Alert Rules.
Click Yes on the delete confirmation dialog box.
Share Alert Rules with Users
After you create an alert rule, you can share it with other users by assigning permissions through user groups.
Share Alert Rules with Users
Go to
Settings >> Logpoint Configuration >> Alert Rules.Select the alert rule you want to share and click the Share to other users (
) icon.To share multiple alert rules, select the rules. Click the More drop-down and select Share Selected Alert Rules With Users.
Select a User Group. All the users in the user group are listed in the drop-down.
Select the Read, Edit, or Full permissions for the users.
Click Submit.
Use Shared Alert Rules
Go to
Settings >> Logpoint Configuration >> Alert Rules.Select Shared Rules from the drop-down.
Click the More icon from the Actions column.
Click the Use Alert icon from the Actions column.
Clone Shared Alert Rules
Go to
Settings >> Logpoint Configuration >> Alert Rules.Select Shared Rules from the drop-down.
Click the Clone icon from the Actions column.
Enter a Name for the cloned rule.
Select the Replace Existing? checkbox to replace an existing rule with the same name.
Click Clone.
Categories of Alert Rules
There are four categories of alert rules: My Rules, Shared Rules, Used Rules, and Vendor Rules. They can be accessed from the drop-down at the top-left corner of the panel.
My Rules
Lists all the alert rules created by the LPSM user or the Fabric-enabled Logpoint user.
Shared Rules
Lists all the shared alert rules.
Used Rules
Lists all the used alert rules.
Vendor Rules
Lists all the alert rules provided in your application packages.
You can click the Clone (
) icon under the Actions column, to use the shared and vendor alert rules. Enter a name for the clone and hit enter. The alert rule is activated, and the clone appears under the My Rules page.
Incidents
Incidents are used to identify, analyze, correct, and prevent information hazards in the future. Logpoint lets you find events such as a system crash, power down, cables unplugged, high disk usage, high CPU usage, and forensics by creating incidents for each of them. Incidents can be created from one of three incident sources; Alert Rules, Search or UEBA.
You can subscribe to incident sources of the connected Fabric-enabled instances from Investigation >> Incidents the navigation bar. Once the incidents of the subscribed sources are created, you can resolve, re-open, close, and comment on the incidents. The incidents are updated automatically in real time.
Subscribe or Unsubscribe to Incidents
Subscribe to Incident Sources
To view incidents for other Fabric-enabled Logpoints, you need to subscribe to the incident sources.
Go to
Incidentsfrom the navigation bar.Click SUBSCRIPTIONS.
At the top-right, click Subscribe.
Select the required incident source.
Click Done.
After successful selection, incident sources are populated under SUBSCRIPTIONS.
If a pool is selected while subscribing to incidents, the new sources added in the Fabric-enabled Logpoints of that pool are subscribed automatically.
If a Fabric-enabled Logpoint is down or unreachable, its corresponding subscribed incident sources are dimmed.
When a Fabric-enabled Logpoint is down, its corresponding incident sources cannot be selected or deselected individually. When a pool is selected or deselected, all the subscribed reports are selected or deselected irrespective of any Fabric-enabled Logpoint being down or unreachable.
Unsubscribe to Incident Sources
Go to
Incidentfrom the navigation menu.Click SUBSCRIPTIONS.
Click Unsubscribe for the incident source.
To unsubscribe incident sources in bulk:
Go to Subscribe button on the top right.
Deselect the incident sources to unsubscribe.
Manage Generated Incidents
When a subscribed alert rule is triggered, an incident is generated and listed in Incidents section.
In the Incident feed, the list of all the incidents is displayed along with their corresponding status. You can perform actions such as: Resolve, Re-open, Close, Re-assign, and Comment on any incident. Additionally, you can send incident notifications for investigation if you have configured the Manual notification trigger for the corresponding alert rules.
Resolve Incidents
Once the appropriate action is taken on a particular incident, you can Resolve that incident.
Go to
Incident >> Incidents.Click the Resolve button of the incident.
Close Incidents
After an incident is resolved, you can close the incident. Once an incident is closed, it is not shown in the incident feed.
Go to
Incident >> Incidents.Click the Close button of the incident.
Closing an Incident
View Incident Data
You can view the details of an incident in a format specified while creating its alert rule.
Go to
Incident >> Incidents.Click the Incident Data button of the incident.
You can monitor each incident’s status using the Incident ID, which is a unique ID of an incident. You can also view the corresponding alert rule’s AlertRule ID.
View Incident Logs
You can view the logs that triggered an incident from the View Data option, which directs you to the Search page to view the logs.
Go to
Incident >> Incidents.Click the View Data button of the incident.
You can view the incident information like Alert Name, Incident ID, and Incident Timestamp from the Incident Info (
) icon on the redirected tab.
Re-assign Incidents
You can reassign an incident to another user only if the user assigned to its corresponding alert rule is deleted from the Fabric-enabled Logpoint. You can reassign the incident to the owner of the alert rule or a user with the Manageable by ownership.
Go to
Incident >> Incidents.Click the Assign to button of the incident.
Select the User.
Send Incidents for Investigation
You can use the Send For Investigation and Re-Send For Investigation options to manually send incident notifications for further investigation.
Go to
Incident >> Incidents.Click the Send for Investigation button.
Other Incident Actions
The More drop-down in the Incident page lists additional actions. You can select the incidents and choose to Resolve Selected, Resolve All, Close Selected, Close All Resolved, and Send Selected For Investigation.
The Resolve Selected and Resolve All options let you resolve multiple incidents at once.
The Close Selected and Close All Resolved options let you close multiple incidents at once.
The Reassign Selected and Reassign All Selected options let you reassign multiple incidents at once. Reassigning opens a window prompting you to select a user to reassign the incidents to.
The Send Selected For Investigation option lets you send the notifications configured for the selected incidents. You can either select a single incident or multiple incidents and send them in an email using the Send Incident(s) for Investigation dialog box.
Enter valid email addresses under Emails.
Enter a Subject.
Select Disable Search Link to remove the search link from the email. The search link redirects you to the search page of the Logpoint instance where the email notification is configured.
Select Enable Logo if you want to include the Logpoint logo in the email notification.
Browse for the image in JPG/JPEG format if you want to provide a custom logo. The maximum dimension for the custom logo is 600*400.
Click Submit.
Fabric-enabled Logpoint
Compatible Fabric-enabled Logpoint Versions
6.9.x
6.9.x
6.10.x
6.10.x
6.11.x
6.11.x to 6.12.x
6.12.x
6.11.x to 6.12.x
7.0.x
6.11.x to 7.0.x
Filter an Incident
To simplify or narrow down the search for a particular incident, you can use filters such as Logpoint Pool, Machine, Name Or ID, Time Range, Risk, Attack Category, Attack Tag, Log Sources, Type, and Status.
The filters are described below:
Pool: Using this filter, incidents can be filtered by the selected Logpoint Pool.
Machine: Using this filter, incidents can be filtered by the selected machine belonging to the selected Logpoint Pool.
Name Or ID: Using this filter, a particular incident can be searched by its name or its Incident ID. You can also search for all the incidents associated with an alert using the AlertRule ID. You can obtain the Incident ID and AlertRule ID by clicking the Incident Data option on the Incident page.
Time Range: Using this filter, the incidents generated at a particular time can be viewed.
Risk: Using this filter, the incidents can be viewed according to a particular severity level (critical, high, medium, or low).
Attack Category: Using this filter, the incidents can be viewed according to the attack categories associated. You can select multiple attack categories from the drop-down.
Attack Tag: Using this filter, the incidents can be viewed according to the attack tags associated. You can select multiple attack tags from the drop-down.
Log Sources: Using this filter, the incidents can be viewed according to the log sources associated. You can select multiple log sources from the drop-down.
Type: Using this filter, the incidents can be viewed by the source (alert, search, or UEBA) where they are generated.
Status: Using this filter, the incidents can be viewed according to their status (resolved, unresolved, or closed).
Last updated
Was this helpful?
Comment on an Incident
You can post comments about the incidents seen in the incident feed. You can track the actions taken over an incident via the comments.
Go to
Incident >> Incidents.Click the Comment button of the incident.