The Incident Detail View

The Incident Detail view has been updated with ease of use and user accessibility in mind. This guide is to help you navigate and operate the new and improved design and functionality.

Navigating the new Incident Detail view

The layout is split across four tabs: An Overview tab, a Notes tab, a Details tab, and a Linked tab.

In the Overview tab you can view all relevant information on a specific incident. Here, you will find a description of the incident, the recommended when it has been made, any entities relevant to the incident, and a timeline overview of events pertaining to the incident (i.e. malicious URLs, I.P. addresses, email accounts, etc).

In the Notes tab you will find the comments board for the current incident and a list of all attachments sent to the comments board. Here, you will be able to add comments, upload images and attachments relating to the incident. Please make sure you never upload malicious files!

In the Details tab you will find extra information about the incident, any background information regarding the incident and a brief assessment of the incident. You will also see relevant links, incident-specific time metrics measuring mean times to handle and respond and any other relevant pieces of information.

In the Linked tab, you will find any incidents which are linked with other incidents or requests for your organisation. Here, we include parents, children, and in some less frequent scenarios also links to related or duplicated incidents.

Interacting with the Incident Timeline

The Timeline card in the Overview tab includes a filter function for you to use if you are searching for something specific.

Simply click to check the boxes, then click apply to implement the filter and the timeline will be narrowed down to your specifications.

Updating Incidents Using Actions Button

The Actions button can be used to update incidents. The actions available to you will differ depending on the current status of the incident.

• You can escalate and incident or request tuning as long as the incident is not yet resolved.

• You can send an incident back to us when we have asked for your input on it and it is in status Customer Action

• When an incident is resolved, you can re-open it

• Note that you can't resolve an incident while we are working on it, this is to preserve our internal workflow and analysis pattern.

Please note that you will be required to provide additional information before taking any alternate actions.

In addition to altering the incident status, the Actions button also lets you submit a Service Request regardless of the incident status. This allows you to communicate with our Security Operations team if you require any specific changes or have any miscellaneous needs.

This will open an input form, simply input the subject and description a click Submit request in the bottom right corner. You will then find them in the Service Requests page under Support in the left-hand navigation menu.

Adding Notes and Attachments

Within Notes you can also add comments and attachments.

To add a comment, simply click inside the comment box and type out your comment.

If we have asked for your input on an incident, you will also see that you'll be able to add comments on an incident without changing the status. This enables you to add context internally before you want to send the incident back to us. Note that all comments added will be visible to our team.

Using the two right-most buttons, you can also add images and other attachments to the message and they will appear either inline or at the end of your comment.

Please note that the file sharing feature is intended for sending supplementary files and images and not malicious files, links and other media.