Security Incident Response Other Records

  • Release version: Washingtondc
  • Updated February 1, 2024
  • 2 minutes to read

    • This section displays the other records such as IT related records and email records. Under IT records, Incident, Change Request, Problem and Outages are displayed.

    Under Email, Draft, Sent Emails and Received Emails are displayed.

    Figure 1. Other Records
    Other Records tab

    Create an incident

    Create an incident within a security incident.

    Before you begin

    Role required: sn_si.analyst.

    Procedure

    1. Navigate to Workspaces > Security Incident Response Workspace.
    2. Open any incident record.
    3. Click Create Incident.
      create incident
    4. Enter the details such as Configuration Item, Impact, Urgency, Location, Priority, and Short Description.
    5. Click Create.Created incident
    6. An incident gets created.

    Create a problem task

    Create a problem task.

    Before you begin

    Role required: sn_si.analyst

    Procedure

    1. Navigate to Workspaces > Security Incident Response Workspace.
    2. Open any incident record.
    3. Click Create Problem.
      Create problem
    4. Fill in the details such as Configuration Item, Location, Impact, Urgency, Priority, and Short description.
    5. Click Create.
      Figure 2.
      Created problem
    6. A problem task gets created.

    Create a change request

    Create a change request.

    Before you begin

    Role required: sn_si.analyst.

    Procedure

    1. Navigate to Workspaces > Security Incident Response Workspace.
    2. Open any incident record.
    3. Click Create Change Request.
      Create change request
    4. Enter the details such as Configuration Item, Location, Priority, and Short description.
    5. Click Create.
      Created change request
    6. A change request gets created.

    Create outage

    Crete an outage from an incident to track the down time of a configuration item.

    Before you begin

    Role required: sn_si.analyst

    Procedure

    1. Navigate to Workspaces > Security Incident Response Workspace.
    2. Open any incident record.
    3. Click Create outage.
      Create outage for a configuration item
    4. Enter the details such as Configuration Item, Begin date, End date, Type, and Short description.
    5. Click Create.
      Create Outage

    Compose Emails

    As an analyst, you can compose emails directly from security incidents.

    Before you begin

    Role required: sn_si.analyst

    Procedure

    1. Navigate to Workspaces > Security Incident Response Workspace.
    2. Select and open the incident for which you want to compose an email.
    3. Click the overflow and select Compose Email.
      User Reported Phishing view: Compose Email section.
    4. Enter the To and CC field.
      Compose email
    5. Add attachments, if any.
    6. Within the Email form, click Quick Messages to view the quick messages which is displayed on the right side of the Compose Emails section.
      The available quick messages are displayed. Select the message and click Insert. The messages gets inserted in the body of the email.
      User Reported Phishing email.
    7. Compose your email and click Send Email.
      Note:
      You can save an email as a draft. These draft emails will be available under the Other records tab.
      How to configure Quick Messages:
      1. Navigate to System Definitions > Tables.
      2. Search for Quick Message (sys_email_canned_message) table.
        System Definitions
      3. Go to Related Links > Show List.
      4. Create New.
      5. Enter the Title, body of the message, select the Table: Security Incident (sn_si_incident) and Active check box.
        Quick message - New record.
      6. Click Submit.
        After a new entry is created within the table, the quick message appears in the contextual menu.
    8. Click Templates to add any template if required.
    9. Select the Response Template and click Copy to clipboard and apply the template, if required.
      Compose email template. How to configure Response Templates:
      1. Navigate to System Definitions > Tables.
      2. Search for the Response Template (sn_templated_snip_note_template) table.
        Response Template Table.
      3. Go to Related Links > Show List.
      4. Create New.
        Creating a New template and viewing available Response Templates.
      5. Enter the Name, Short Name, select the Table: Security Incident (sn_si_incident) and Template body.
        Response Template: record view.
      6. Click Submit.
        After a new entry is created within the table, the new template appears in the contextual menu.