After upgrading to Symantec Endpoint Detection and Response (SEDR) 4.9, the triggering events in an incident's 'Events' tab no longer contain the red text "TRIGGERING EVENT" in their description. However, triggering events listed in the incident's 'Process Lineage' tab still contain the red text "TRIGGERING EVENT" in their description.
SEDR 4.9
An internal issue caused SEDR to fail to display the red text "TRIGGERING EVENT" in the triggering event's description.
This issue is resolved in SEDR 4.10.
If upgrading to SEDR 4.10 is not possible then use the patch CLI command to install atp-patch5-4.9.1-1.