How to use Incident Management

Larry Wile Updated by Larry Wile

How to use Incident Management

Overview

Incident Management empowers security teams to rapidly investigate and resolve security incidents. By streamlining evidence gathering (including footage), minimizing manual documentation, accelerating resolution times, and enhancing operational efficiency.

Prerequisites

Incident Management is included on Enterprise Edition and is available separately on other editions. 

Creating an Incident

  1. On the left navigation bar, navigate to the Dashboard.
  2. Select an event and the side drawer will open.
  3. Select Create New Incident and the incident is created.
    1. Optionally, this can also be done from Event Tracker.

Adding events & footage to an Incident

  1. On the left navigation bar, navigate to the Dashboard.
  2. Select an event and the side drawer will open.
  3. Select the Add to Incident drop down and select the incident to add the event.

Reviewing Incidents

  1. On the left navigation bar, select Events and then Incident Management.
  2. The Key Performance Indicator (KPI) tiles at the top of the page provide the status of New, In Progress, and Closed. Select any of the tiles to filter for the incident statuses.

Updating and Commenting on Incidents

  1. On the left navigation bar, navigate to Incident Management.
  2. Select an incident to open, select the drop down status at the top of the page and change the status of the incident.
    1. Options are New, In Progress, and Closed.
  3. Comments can be made at the bottom of the page by simply typing your comment and selecting Add Comment.
  4. All comments are added to the incident timeline and journaled in the event journal.
    1. This allows for administrators to collaborate on incident investigations.

How to use video

Eagle Eye Integration

Navigating the Menu

Open Eye Integration

How-to Video

How did we do?

Using Event Classification

Using Snapshot Log

Contact