Yes, contact us to enable the SOC (Security Operations Center) quick-label feature.
Triaging with Quick Labels
Quick Labels are shown as one-click menu items in the dropdown for each Event when you press the labels icon. They're intended to be a fast triaging tool to characterize Events that warrant attention.
The labels shown on the dropdown list come from two sources, in order of precedence:
- Domain-level Quick Levels
The comma-separate list of labels specified at https://camio.com/domains becomes the standard list shown to all people viewing Events from an account from that domain.
- User-level Most Recently Used Labels
As users apply labels to Events, the most recently used labels are appended to the dropdown list (following those from domain-level specification).
If you're a domain administrator, enter a comma-separate list of labels that you'd like all people to use when triaging Events from accounts using your domain at:
Click Edit... if you need to add or remove a label that isn't yet shown in your most recently used list. After you press Save, the newly added/removed label will appear in your most recently used list and will be saved locally in your browser.
The NOT logical operator may also be helpful so that you can use a query like this to review and share those Events that are suspicious and not yet reviewed:
suspicious not reviewed
That way, SOC personnel can bookmark URLs that they want to see most commonly like: