View Major Security Incident impact metrics
Summarize
Summary of View Major Security Incident Impact Metrics
This feature provides a comprehensive reporting tool for managing major security incidents through the Major Security Incident Management workspace. It allows users to monitor the impact and progress of incidents effectively, including metrics on affected assets, users, and teams, alongside significant milestones in the incident resolution timeline.
Show less
Key Features
- Overview Tab: Displays relevant metrics such as affected assets, users, and a timeline of milestones.
- Timeline Component: Provides a visual representation of key events with the ability to expand and collapse for detailed viewing. Updates automatically with new milestones.
- Executive Summary: Allows for quick modifications and copying of incident summaries.
- Incident Impact Display: Aggregates impacted resources and allows for drill-down navigation to specific details.
- Duration Counters: Shows elapsed time, estimated resolution date, and next update timing for incidents.
- Custom Event Creation: Users can create new timeline events for better tracking of historical actions or future plans.
- Event Filtering: Enables customization of displayed event types in the timeline for focused views.
Key Outcomes
Utilizing these features helps customers manage major security incidents more effectively by providing clarity on incident scope and progress. Users can expect timely updates, a clear overview of the incident status, and the ability to track and report on significant milestones, ultimately leading to better incident resolution and resource management.
Provides up-to-date summary reporting of the impact and progress of major security incidents, which is an important aspect of managing a major security incident using the new workspace.
The Overview tab provides the relevant metrics to manage both the scope and progress of the incident, including a rollup of affected assets, users, locations, and team resources, as well as the timeline of significant incident milestones.
Timeline provides a horizontal view of key events and milestones that have occurred as part of the specific major security incident resolution. The timeline component is displayed on top of all the Major Security Incident Management workspace tabs with an ability to collapse and expand for viewing as required. The events data represented will be updated and refreshed whenever designated milestone events or milestones are added or updated.
Each event or milestone is indicated with a different timeline event type option to identify the number and type of events or milestones. For example NOW record updates, collaboration activities. In addition, the time range period for the different major security incident states is tracked automatically and displayed using color-coded ranges displayed along with the duration of each incident state.
| Task | Description |
|---|---|
| Executive Summary | A brief summary of the major security incident along with the user name, user role, and timestamp details.
|
| Incident Impact | These components display the impacted resources based on a rollup of all active tasks and linked incidents with identified assets, users, locations, and assigned team members. The impacted resources are:
Selecting the number values enables you to drill down and navigate to the impacted assets, users, and location details and displays the related tasks on the Incident Impact tab of the workspace. Based on your selected incident impact type link, the related incident details such as task type and its description, assignment group and incident state are displayed in the tab of the MSIM workspace. |
| Duration counters | These components display the duration of the major security incident. The impacted resources are:
|
You can enable or disable viewing of certain event types for both timeline indicators and timeline ranges accordingly using the filter toggle buttons.
| Task | Description |
|---|---|
| New Event | Creates new custom events and associates these events to the MSI record. This helps in creating events for both past and future dates that might not otherwise get captured via a labeled task, record state change, or labeled collaboration activity, which are displayed by default on the timeline. |
| Refresh | Refreshes the Timeline events to display the latest updates. |
| Timeline Indicators | Lists the various types of events such as Now Record field changes, Labeled Collaboration Activities, and Other (custom), along with the icons and total number of events that occurred with respect to each event type indicator. The slide indicator enables you to enable or disable all events for a specific event type. |
| Show Legend | Select to display the drop-down legend with different types of timeline indicators. |
| Timeline progress bar | Displays the overall progress of the incident via designated timeline events or milestones that are occurred within the different timeline ranges displayed. You can also link an Event type to an Event category. After you link it, the Event details get updated at both places on the timeline. |
| Timeline ranges | Displays various incidents state types and duration as the incident progresses throughout the full major security incident life-cycle. Enable or disable a specific event based on the incident state. |
Create a Timeline event
- In the Overview tab, navigate to the Timeline section.
- Select .
- On the Add a new timeline event pop-up, fill the fields.
Figure 3. New Timeline event Task Description Title Enter the title for the timeline event. Category Select a category for the timeline event. The following categories are provided as a part of the base system, and you can choose one based on your requirements.- Custom.
- Response.
- Threat.
To add or configure a Timeline event category, see Configure timeline categories for major security incidents.
Timestamp Select the date and time of the timeline event using the Timestamp calendar. You can add events to the Timeline before and after the start date. Description Provide a brief description about the timeline event. Linked to Option to link the timeline event to a major security incident record. - Select .
- You can use Zoom in and Zoom out icons to zoom in or out on the timeline progress bar, which includes displaying individual events when numbers are displayed to represent
several events in close time proximity.
You can also add the default zoom level to show all events.
- Select the Refresh icon to display the latest timeline events.