This article discusses how you can use the Stories Workbench to review stories for potential threats in your account.
Overview of Detection & Response Stories
Cato Detection & Response is an additional layer of security that creates stories for threats. When Cato’s advanced correlation engines analyze traffic data and find a match for a potential threat, they generate a story. The story contains data from traffic flows with common properties that relate to the same threat. The Stories Workbench page shows the details of each story to help you understand and analyze the threats. You can sort and filter the stories to find the most important potential attacks, and then drill-down on a story to further investigate the details.
These are examples of data that a story can include:
Sources in your network
External targets of network traffic
Identification and description of the threat
Relevant geolocations
Related applications
Relevant events
Popularity of the target according to Cato internal data
Malicious score of the target according to Cato machine learning models
Required Licenses
Additional licenses may be required. For more information, see Welcome to the Cato XOps Service
Showing the Stories Workbench Page
Once you have created the connector, stories will be visible in the Stories Workbench.
To view the Stories Workbench page:
From the navigation menu, click Home > Stories Workbench.
Understanding the Stories Columns
Column | Description |
|---|---|
ID | Unique Cato ID for this story |
Created | Date of the first traffic flow for the story |
Updated | Date of the most recent traffic flow for the story |
Criticality | Cato's risk analysis of the story (values are from 1 - 10) |
Indication | Indicator of attack for the story. For more about indications, see Using the Indications Catalog |
Source | IP address, name of device, or SDP user on your network involved in the story |
Engine Type | The security engine that created the story. |
Status |
|
Grouping the Stories
To provide context when reviewing the stories, you can show the stories in groups defined by details including Source, Indication, Status, and Type. For example, you can show together all of the stories related to a specific source IP address or all of the Cybersquatting stories. This gives you a broader perspective when analyzing the stories, and can help you reach faster and more accurate conclusions.
Each group highlights the criticality levels for the stories in that group, including the number of high, medium, and low criticality stories.
To group the stories in the Stories Workbench:
From the navigation menu, click Home > Stories Workbench.
From the Group By drop-down menu, select the required criterion.
The stories are shown in expandable groups.
Filtering the Stories
There are three ways to filter the data in the Stories Workbench:
Select a preset filter
Automatically update the filter with a selected item
Manually configure the filter
Preset Filters
You can select a preset filter to focus on either Network Operations or Security Operations stories. When you select a preset filter, the story columns most relevant for that type of story are shown by default.
To select a preset filter:
In the filter bar, click the Select Presets dropdown menu.
Select the preset. The Stories Workbench is updated to show the stories that match the preset.
Automatically Filtering for an Item
As you hover over an item or field where a filter option is available, the 
button appears. Click the icon to show the filter options:
Add to Filter - Adds the item to the filter, and the Stories Workbench now only shows stories that include this item. For example, if you filter for a specific Criticality score, the page only shows stories with that Criticality.
Exclude from Filter - Updates the filter to exclude this item, and the Stories Workbench now only shows stories that do NOT include this item.
You can continue to add items to the filter, click again to update the filter and drill-down further.
Selecting the Time Range
The default time range for the Stories Workbench is the previous two days. You can select a different time range to show a longer or shorter time period. For more information, see Setting the Time Range Filter.
The maximum date range for the Stories Workbench is 90 days.
Manually Configuring the Filter
You can manually configure the story filter for greater granularity to analyze the stories. After you configure the filter, it is added to the stories filter bar, and the page is automatically updated to show the stories that match the new filter.
To create a filter:
In the filter bar, click
.Start typing or select the Field.
Select the Operator, which determines the relationship between the Field and the Value you are searching for.
Select the Value.
Click Add Filter. The filter is added to the filter bar and the Stories Workbench is updated to show stories based on the filters.
Clearing the Filter
You can remove each item in the filter separately, or clear the entire filter.
To clear the filters for the Stories Workbench page:
To clear a single filter, click
next to the filter (item 1 above).To clear all the filters, click X at the right end of the filter bar (item 2 above).