View related items for a security incident
You can view related items, such as similar and child security incidents, related users, vulnerability groups, and vulnerable items associated with a security incident.
Before you begin
Role required: sn_si.basic
Procedure
- Navigate to Workspaces > Security Incident Response Workspace.
- Open the security incident for which you want to view related items.
- Select the Related Records tab.
-
Select any of the related lists to view or add
information for the security incident.
Tab Description Child Security Incidents The task record related to the issue that created the caused this security incident. Similar Security Incidents Other security incidents associated with any of the same observable records. The Link as Children button can be used to assign the selected similar security incidents as the children of the currently opened security incident.
Related Configuration Items Displays a list of security incidents containing configuration items with the same observable as this security incident. This list can be filtered using the CI exclusions filter group. When an observable is added to a security incident this list is automatically updated. By default, observables with a context type of Destination are excluded.
Related Users Displays a list of security incidents containing users with the same observables as this security incident. This list can be filtered using the User exclusion filter group. When an observable is added to a security incident this list is automatically updated. By default, observables with a context type of Destination are excluded. Related Filter Group After configuration items are identified, any matching CI or Filter group are automatically added. Vulnerability Groups If Vulnerability Response is activated, you can view vulnerability groups associated with this security incident. Vulnerable Items If Vulnerability Response is activated, you can view vulnerability items associated with this security incident. Risks If any of the core Risk Management plugins (Policy and Compliance Management, Audit, Management, or Risk Management) are activated, you can view or add risks associated with the security incident. This related list can be from the form header context menu under Configure > Related Lists.
Configuration item events Tab to view events, if Event Management is activated. Configuration item alerts Tab to view alerts, if Event Management is activated. Customer Service Cases Tab to view Customer Service case information, if Customer Service is activated. - Select any of the following related links to further update the security incident:
- Select Submit.