Product Training – Lumu’s New Incident View

This product training video presented by Nikki Ibarra, Lumu’s Director of Product Marketing, introduces the updated incidents view within the Lumu portal. The portal focuses on improving operability and information accessibility for cybersecurity teams. The presenter highlights how the new interface organizes data into specific tabs — Activity, Highlights, Threat Intelligence, and MITRE ATTACK Matrix — to provide clear context on threat movements and endpoint impact. This structure allows users to filter incidents by type, such as malware or phishing, and manage them directly through actions like closing, muting, or commenting. Key additions to the Lumu portal include the Operation Timeline, which fosters team collaboration by tracking actions taken on an incident and allowing for shared comments. The portal also emphasizes data portability, offering various export options like STIX reports and CSV files for affected endpoints and contact details. Additionally, the presentation covers how Lumu Defender can automate responses through API and out-of-the-box integrations, enabling real-time intervention to prevent threats from escalating within an organization.

---

Takeaways

• The new view is designed to enhance operability and accessibility of key cybersecurity information for all users.
• Four distinct tabs (Activity, Highlights, Threat Intelligence, MITRE ATT&CK) provide structured, intentional context for every detected incident.
• The Operation Timeline is a new collaborative feature allowing team members to track actions, status, and leave comments on incidents.
• Incident data, including IOCs, affected endpoints, and STIX reports, can be exported to CSV or other formats for external records.
• Lumu Defender integration enables automated real-time response and blocking of malicious contact by leveraging existing cybersecurity investments.

---

FAQs

What is the purpose of the Highlights tab in the new incident view?

It visualizes how a threat moves across the organization, providing context on timelines and the frequency of contact between endpoints and IoCs.

How does the Operation Timeline assist cybersecurity teams?

It enables collaboration by showing when an incident was created, who has read it, and allowing team members to record actions or comments.

Can users see specific technical data for an affected endpoint?

Yes, by clicking on see more details on an asset, users can access packet data and technical metadata from the collector.

What kind of information is found in the Threat Intelligence tab?

It contains details on malware families, related IoCs, hash files, external resources, and a specific incident response playbook.

How can organizations automate their response to detected incidents?

Organizations can use Lumu Defender to integrate with their existing security stack via APIs or out-of-the-box integrations for real-time blocking.