You can create a process definition to define the way security incidents transition from one state to the next. Process definitions give service desks and end users help tracking the problem throughout its life cycle.

1. Navigate to Security Incident > Administration > Process Definition.
2. Click New.
3. Fill in the fields, as appropriate.

   Table 1. Creating process definitions

   Field	Description
   Name	Name of the record which describes the process encoded in the script include file. The name is displayed as a choice in the Process Definition Selector list.
   Script include	The name (including the sn_si. prefix) of the script include containing the definition of the process. The script must be in the Security Incident (sn_si) application scope. See Create a custom Security Incident Response process definition script include for more information. If this field does not contain a valid script include name, the default ProcessDefinition_NIST_Stateful definition is used.
   Description	Helpful information about the script include.
   Order	Determines the position in the process definition list.
   Active	When checked, it makes this process definition selectable from the Process Definition Selector page.

4. Click Submit.

Set up a security incident group and assign the appropriate roles and users to the group.

1. Navigate to User Administration > Groups or Security Incident > Setup > Groups.
2. Click New.
3. Fill in the fields.
4. Make sure that you select the security incident type for this group.
   1. If the Type field is not visible, configure the form to add it.
   2. Click the lock icon beside the Type field.
   3. Click the reference lookup icon ()
   4. Search for and select the security incident type.
5. Right-click the form header and select Save.
6. In the Roles related list, add the roles that each member of this group receives. For example, if you are making a group for Security Incident Response team members, add sn_si.analyst. If you are making a group for Security Incident Response administrators, add sn_si.admin.
7. In the Group Members related list, add users to this group.
8. Click Update.

Security incident calculator groups are used to group calculators.

1. Navigate to Security Incident > Setup > Security Incident Calculator Groups.
2. Click New.
3. Fill in the fields on the form, as appropriate.

   Field	Description
   Name	The name of the security incident calculator.
   Application	The application that contains this record.
   Order	The order in which the security incident calculator is run. A calculator with an order entry of 100 runs before a calculator with an order entry of 200.
   Description	A description of this calculator group.
   Created by	Enter the name of the user who created

4. Click Submit.

You can define a Service Level Agreement (SLA) for the security incidents.

1. Navigate to Security Incident > Setup > SLAs.
2. Click New.
   For field descriptions and detailed instructions, see Create an SLA definition.

A runbook is an association between a published knowledge article and a specific task. While you are performing the task, a knowledge article in the runbook automatically opens, providing information pertinent to the task.

1. Navigate to Security Incident > Manual Runbook > Create New Runbook.
2. Fill in the fields, as appropriate.

   Field	Description
   Knowledge article	Select a knowledge article to include in the runbook.
   Active	Check the box to make the runbook available from the Filter Navigator.
   Use filter group	Select this check box to use a predefined filter group or create a new filter group to define the runbook criteria.
   Filter group	Select the filter group to use for defining a runbook. This field appears only if the Use filter groups check box is selected.
   Table	Select either Security Incident [sn_si_incident] or Security Incident Response Task [sn_si_task]. If you selected the Use filter group check box and selected a filter group, this field defaults to the table associated with the selected filter group.
   Condition	Set the conditions that connect this runbook to the incident or task. If you selected the Use filter group check box and selected a filter group, the Condition fields are not displayed.

3. Right-click the form header and select Save.
   The Knowledge Article Details tab and a series of buttons appear.
4. To view the details of the runbook, click the Knowledge Base Details tab.
5. To see the knowledge article as it would appear to the user, click View Article.
6. To edit the details of the knowledge article, click Edit Article.

When your employees receive emails that appear to be phishing attacks, they can report them to you using a phishing email address. The suspicious email is validated using rules defined by your organization.

1. Navigate to Security Operations > Email Processing > User Reported Phishing.
2. Click New.
3. Fill in the fields, as needed.

   Table 6. Email Matching Rules form

   Field	Description
   Name	Name for this email matching rule. For example, User Reported Phishing.
   Conditions	Use the condition builder to validate whether an email sent to your company phishing email address is a phishing attack. See the following example.

4. Click Submit.

Example

This example shows a matching rule for handling user-reported phishing.