ContraForce Command Page

ContraForce supports multi-tenant use cases with the Command page. This article will provide an overview of the features included on the Command Page.

Overview

The Command page serves as a central hub for overseeing multiple Microsoft tenants via a user-friendly dashboard. By default, it displays data for all onboarded tenants, with the option to customize the view by filtering workspaces. The Command page features 4 data cards:

• Incident Tracker
  • Shows the number of High severity incidents and total number of incidents per workspace
• Latest Gamebook Activity
  • For each gamebook action that has been ran in ContraForce, the Workspace, Status, Incident, and Owner are shown. The specific incident ID is shown and is hyperlinked to the incident summary card.
• Data Connector Anomalies 
  • Lists all detected data connector anomalies per workspace. The name of the data connector is hyperlinked to the workspace's Data Connector library. 
• Incidents
  • Incidents for all connected workspaces are shown by default. The incidents table can be filtered to show specific workspaces. The table can also be filtered by Severity and Status. Additionally, incidents can be bulk selected and updated as needed by the operator.
  • The table includes columns for the Severity of the incident, associated Workspace, Incident Title, Incident ID, Creation Time, Status, and Owner. 
  • The Incident Details page can be accessed by clicking the Incident ID. 

How do I use the Command page?

The ContraForce Incident Management User Guide provides an overview of how to manage incidents in ContraForce from the analyst perspective.