Manually Adding Incidents

You can log incidents in the application and use the incident record to manage the workflow, associated assessments, and other related tasks. An incident is a security event that results in a breach or violation of security policies, procedures, or controls. Logging incidents helps to streamline your breach investigation, improve incident visibility, and strengthen issue management. Once you create an incident, you'll be able to assess jurisdictions and create guidance to respond to incidents as needed.

To add an incident

  1. On the Incident Management menu, select Incident register.

    The Incident register screen appears.

  2. Click the Add Incident button.

    The Add new incident screen appears.

  3. Complete the fields. For more information, see Add New Incident Screen Reference. 
    Note:

    All active custom attributes for incidents will appear on the Add New Incident screen for you to complete as needed.

  4. Click the Save button. 

Add New Incident Screen Reference



Field
Description
Incident Type

Select the type of incident that occurred.

Organization

Select the organizational group which is managing/responsible for the incident.

Incident Name

Enter a name for the incident.

Assignee

Select the user(s) who are responsible for managing the incident. All users added to an incident will receive a notification informing them that they have been assigned to the incident.

Note:

The incident assignee field displays user groups from all organizations. For Incident Management use cases, Admins should create groups with users from the same organization. When assigning an incident to a user group, ensure the group contains users from the organization assigned to the incident.

Description

Enter a brief description of the incident.

Note:

If any private hyperlinks or URLs are used here, you may need to update or rename them. For example, rename web.config to web[.]config or webDOTconfig.

Firewalls frequently block payloads containing the keyword web.config due to its association with potential malicious activity.

Date Occurred

Select the date and time on which the incident occurred.

Date Discovered

Select the date and time at which the incident was discovered.

Deadline Date

Select the date and time at which the incident must be completed.

Root Cause

If you have determined a root cause for the incident, enter it.

Notification Needed

Select if the incident requires a notification.

Note:

This field is will be automatically updated by the Dynamic Incident Notification Assessment.

To export incidents to Excel

You can export all incidents in the Incident Register to an Excel spreadsheet. You can designate a PDF report as your organization's default report template for incidents. The configuration of the PDF report that you set as the default PDF will be used when the Incident Register is exported. For more information, see Setting a Default PDF.

  1. On the Incident Management menu, select Incident register.

    The Incident register screen appears.

  2. Click the Export (Export icon.) icon.

    The Export data modal appears.


    Export data modal showing export options.
  3. Click the Export data button. The export will be generated in the background. When the report is ready to download, a notification will appear on the Notifications icon button.
  4. Click the Notifications icon button.

    The Notifications popover appears.


    Notifications popover showing available export download.
  5. Click the export link in the popover to download the exported list.