Can we use 'Priority' instead of 'Severity' on Security Incident Response Form/Process - any issues?

[WazzaJC]

Can we use 'Priority' instead of 'Severity' on Security Incident Response Form/Process - any issues?

Dear Community Colleagues,

Can you foresee any issues, if we are to use 'Priority' instead of 'Severity' in the Security Incident Response Form and related Process?

So if we are to hide the 'Severity' field (allowing it to function in the background but not be visible on the Form view) and rather configure and use the 'Priority' field (similar to a standard Incident), are there any issues we should foresee or it is entirely possible to use 'Priority' for Security Incidents?

This is in relation to using the Security Incident Response (SIR) module, which uses the sn_si_incident Table and SIR process.

Many thanks for any help/feedback to help in this regards.

[RaghavSh · Accepted solution]

@WazzaJC I do not see any issues w.r.t to functionality.

There are some OOB SIR calculator groups populating severity, if not required you can remove them or get the priority populated for same conditions.

Check if there is some integration populating severity and if you need to do same for priority.

Severity is the term linked to security incidents , so users are more comfortable with using this term. I dont see any impact with hiding severity and using priority.

Please mark the answer correct/helpful accordingly.

[WazzaJC]

@RaghavSh thank you very much, that all makes sense and is really helpful, I appreciate your help & great input on this, many thanks kind sir! 🙂