Discrepancy Between Counts in Reports and Threats Page

Issue

There is a discrepancy in counts observed in one or more reports (e.g. Red Canary by the Numbers) and threats seen on the Threats page.

Environment

Red Canary Portal > Reports

Resolution

For threats resolved as testing, you can disable the Exclude threats marked as testing from reports setting to include them in your report counts.

For threats suppressed by Threat Review Agent, these cannot be included in reporting at this time, even if reopened.  You should modify your explicit instructions under Customizations, as needed, to ensure only desired activity is being suppressed.

Cause

There are multiple possibilities why a threat may not contribute to a total in one of Red Canary's reports.

• Threats resolved as This was testing are not included in reports if the Exclude threats marked as testing from reports setting is enabled under your Company Profile
• Threats in state:suppressed are not included in report counts
• Suppressed Threats that have been reopened are not included in report counts, even if no longer in state:suppressed