View Clear Text Authentication over HTTP Events

When any connection in the network uses clear text authentication over HTTP, an AlertEvent is triggered and recorded. To view AlertEvent incidents:

1. Click the Hunt tab, and then click Activity.
   The Activity page appears and displays the dynamic chart and Hunt Activity table with a list of the most recent incidents. 
   

   

   The legend at the bottom of the dynamic chart shows the types of incidents detected within the specified time frame.

2. To display a specific type of incident, click that incident type in the legend. For example, click AlertEvent to exclusively display AlertEvent incidents. Incidents associated with the detection of clear text authentication over HTTP are categorized as AlertEvent incidents.
   The dynamic chart displays only the selected incident type, and the blue entry_type tag appears above the chart on the left side.  
   

3. To reset the dynamic chart to display all incident types, point to the blue tag and click the Delete icon.