Export the Security Triage Record
Give an auditor the record of how security incidents were handled over a period: each incident's triage actions and the suppression rules that were in effect. The export is for SOX, HIPAA and DORA reviews, and it is itself recorded in the audit trail.
Before you start
Only administrators can export. The record covers incidents that have at least one triage action (an assignment, acknowledgement or resolve), so an incident nobody has acted on is not in it. Find those in the incident list under the New status. For how triage works, see Triage a security incident.
Export a date range
- Open the dialog. On Security → Activity → Correlated findings, select Export triage record.
- Choose the range. Pick the first and last day, in UTC, up to 366 days. The record holds incidents whose first finding falls in the range, with all of their triage actions, and suppression rules that were in effect at any time in the range.
- Choose the format. JSON is the full record. CSV has one row per action, with incident actions first and then rule actions. Rule rows carry the rule's reason and expiry.
- Decide about notes. Resolve notes and revoke reasons are free text and may hold sensitive detail, so they are left out unless you select Include analyst notes.
- Download. Select Download. A range that holds more than 50,000 incidents or 250,000 actions is refused; choose a shorter one.
What the file contains
| Part | Content |
|---|---|
| Header | Schema version, when it was generated and by whom, the range, and the grouping version. |
| Incidents | Id, actor, pattern, target, first and last finding times, current status, disposition, assignee, acknowledged and resolved times, and every action with its actor, role and time. |
| Suppression rules | Id, matcher, reason, state, start, expiry and revoke time, with a created event and, if revoked, a revoked event. |
| Integrity | events and sha256, described below. |
Times are UTC. The time from an incident's first finding to its first acknowledgement and to its resolve can be computed from the file.
If the triage retention setting has deleted actions, an incident that is still open stays in the record. Every such incident whose first action is older than the latest deletion has historyPurged set, because some of its actions may be gone; its status and times are all that remain of them.
Check that the history was not edited
integrity.events is the number of events in the file and integrity.sha256 is a SHA-256 hash over them. The events are the incidents' events in file order, then the rules' events in file order. The incidents and rules are read in one snapshot, so a file never mixes states from before and after a concurrent action. Each event is written as compact JSON on one line, with its fields in the order they appear in the file and without HTML escaping, followed by a newline. Hash those lines together and compare the result. Editing, adding or removing any event changes the hash, and so does including or leaving out notes, so compare a file against its own value.
Every event names its incident or rule (subjectType, subjectId), and a rule's created event also carries the rule's matcher, reason and expiry, so the hash covers which incident an action belongs to and what a rule matched. The summary fields are not hashed: an incident's status, disposition, assignee and times, and a rule's state and revoke time. They are derived from the events, so check that they agree with them. The hash detects a change to the recorded history: the actions, their order, who took them and what each rule matched. It does not cover the rest of the file, and it is not a signature or proof of who produced the file. The configuration audit trail records each export with its range, format, event count and hash, so you can compare a file you were given against the entry for that export. A CSV cannot be hashed itself: its response carries the same two values in the X-Triage-Record-Events and X-Triage-Record-Sha256 headers, and they can be recomputed from the JSON export of the same range with the same notes choice.
Audit
Every export is recorded in Security → Activity → Configuration as security_triage.exported, with the range, format, whether notes were included, the counts and the hash. The export is refused if that record cannot be written.
For the API, see Triage record export.