Escalate a security incident

If an escalation path exists for a security incident, the Escalate button is available in the security incident header.

Before you begin

Role required: sn_si.admin

You must have an escalation group created to see this button. See Create a Security Operations user-defined escalation group for more information.

Procedure

  1. Navigate to Security Incident > Show Open Incidents.
  2. Open the incident you want to escalate.
  3. Click on the Escalate button.
  4. Choose an escalation group.
  5. Enter a reason for the escalation.
  6. Click Submit.
    Updates Assignment Group and Assigned to on the security incident.