Add incident details to a security incident

After a security incident is created, you can add more details to aid in analysis, such as access roles and different kinds of notes.

Before you begin

Role required: sn_si.basic

Procedure

  1. If it is not already open, open the security incident you want to update.
  2. Click the Incident Details tab.
  3. Fill in the fields, as needed.
    Field Description
    Read access Gives a user with the special access role read access to the security incident. The user is able to read and write work notes. See Roles installed with Security Incident Response for more information.
    Note: If a user is added to both Read access and Privileged access lists, then only the Privileged access permissions persist.
    Watch list Click the lock icon to add users who are notified when changes to the security incident occur. After the field is unlocked, options are available for adding or removing multiple users or entering user email addresses. When you have completed your entries, click the lock icon to lock the field.
    Privileged access Gives a user with the special access role read and write access to all fields of the security incident except Assigned to. Users with special access roles have their own module containing all security incidents assigned to them. No other modules are available to them. No one else can see the Visible to Me module.
    Note:

    Only an assigned user or someone with a security role (for example, sn_si_analyst or sn_si.admin) can change the Assigned to field.

    If a user is added to both Read access and Privileged access lists, then only the Privileged access permissions persist.

    Work notes list Click the lock icon () to add users who are notified when new work notes are added. After the field is unlocked, options are available for adding or removing multiple users or entering user email addresses. When you have completed your entries, click the lock icon to lock the field.
    Description Enter a full description of the security incident, along with any information that can help to find the cause or resolve the issue.
    Secure notes Click the lock icon to unlock the field, enter work notes that are visible to the security users, and click the icon again to lock it.
    Additional comments Enter comments that are visible to the requesting user.
    Work notes Select this check box to change the Additional comments field to Work notes. Work notes are not visible to the customer.
    Activity All task activity (actions, comments, work notes, and so on) on related records for this security incident. This field is dynamically updated as other users work on this incident or tasks related to this incident.
  4. Click any of the following tabs to further update the security incident:
  5. When you have completed your entries, click Submit.