Annotating Patterns

Annotation is a light-weight method to escalate a pattern to other users through your workflow system for analysis or investigation. You can use annotations instead of cases to escalate only one pattern. Use cases to escalate multiple patterns or if you use a third-party incident management system.

You can annotate patterns from the snapshot and Pattern views in the Viewer panel, or within the Pattern Inspector in the Inspect/Edit panel.

To access the Annotation Editor from the Snapshot Patterns view:

  1. In the Navigator panel, go to Pattern Discovery and click the Snapshots tab.

  2. Double-click the snapshot to display it in the Viewer panel.

  3. Expand the pane so you can see the Patterns view at the bottom.

  4. Right click any item in the pattern block and select Annotate Pattern. You can also click the Annotate Pattern button () in the button menu.

To access the Annotation Editor from the Pattern Inspector:

  1. In the Navigator panel, go to Pattern Discovery and click the Patterns tab.

  2. Navigate to the pattern and double-click it.

  3. In the Inspect/Edit pane on the Pattern Inspector tab button menu, click the Annotate Pattern button.

  4. In the Resource Annotation editor, enter the following values and click OK.

    Field

    Value

    Stage

    Select a stage from the drop-down menu. The default is Queued.

    Assign to

    Select a user from the drop-down menu.

    Comments

    Enter any comments to communicate to other ArcSight users.