Directly from a URL, or from an email hyperlink (produced by an event action).
Note: You can add more than one comment to an event.
From the Events Page
1. Click the expand button in the left-most column of the event grid.
The events detail and comment screen opens:
Comment box
Comment button
Comment history list
Collapse icon of the event row
Event details
2. Type a comment in the comment box.
The comment box expands. Note: The comment box has scroll bars for lengthy comments.
3. Click the Comment button to save the comment.
The comment box is cleared and the Comment button appears dimmed.
The comment is saved, with a time stamp and the user name. This is displayed in the comment history list.
4. Click the collapse button of the event row, to close the event history and comments tab.
From the Timeline report
1. Find an event on the timeline report.
2. Click the event icon. Note: The event icon is circled in blue when you hover the mouse over it.
An Event, Info and Comment screen appears.
3. Click the Comments tab of the Event, Info and Comment screen.
Comment box
Comment button
Comment history list
4. Type a comment in the comment box.
The comment box expands. Note: The comment box has scroll-bars for lengthy comments.
5. Click the Comment button to save the comment.
The comment box is cleared and the Comment button appears dimmed.
The comment is saved, with a time stamp and the user name. This is displayed in the comment history list.
6. To close the Event, Info and Comment screen, click any part of the timeline report.
From an Action Email URL
If an action email includes a URL to the event comment (where the Comment Link token is included in the email action), you can open the asset report timeline with the comment box open.
1. Open the action email.
2. Click on the comment link.
The timeline report appears, containing the event that caused the email action. The Event, Info and Comment screen opens, with the cursor in the comment box, in the Comments tab.
3. Type a comment. Then click the Comment button to save the comment.
Note: Alternatively, you can set the appropriate parameters in the asset report URL, and use this URL to open the comment tab for the relevant event.
Adding Comments to an Event in Sentinel
ON THIS PAGE:
You can add event comments from:
Note: You can add more than one comment to an event.
From the Events Page
1. Click the expand
button in the left-most column of the event grid.
The events detail and comment screen opens:
2. Type a comment in the comment box.
The comment box expands. Note: The comment box has scroll bars for lengthy comments.
3. Click the Comment
button to save the comment.
The comment box is cleared and the Comment button appears dimmed.
The comment is saved, with a time stamp and the user name. This is displayed in the comment history list.
4. Click the collapse
button of the event row, to close the event history and comments tab.
From the Timeline report
1. Find an event on the timeline report.
2. Click the event
icon. Note: The event icon is circled in blue when you hover the mouse over it.
An Event, Info and Comment screen appears.
3. Click the Comments tab of the Event, Info and Comment screen.
4. Type a comment in the comment box.
The comment box expands. Note: The comment box has scroll-bars for lengthy comments.
5. Click the Comment
button to save the comment.
The comment box is cleared and the Comment button appears dimmed.
The comment is saved, with a time stamp and the user name. This is displayed in the comment history list.
6. To close the Event, Info and Comment screen, click any part of the timeline report.
From an Action Email URL
If an action email includes a URL to the event comment (where the Comment Link token is included in the email action), you can open the asset report timeline with the comment box open.
1. Open the action email.
2. Click on the comment link.
The timeline report appears, containing the event that caused the email action. The Event, Info and Comment screen opens, with the cursor in the comment box, in the Comments tab.
3. Type a comment. Then click the Comment
button to save the comment.
Note: Alternatively, you can set the appropriate parameters in the asset report URL, and use this URL to open the comment tab for the relevant event.