I have few questions - 1) What is a proper way to close a major security incident because there could be linked security incidents that are still in the open state? 2) What happens to the status report in this case? 3) How to change between various states of a major security incident as I have noticed that you can still be in the draft state while all the tasks you assign to various people have been completed. When do you go to the next state of analysis if there are no more tasks to perform? 4) I could only see one UI Action button on this workspace when you open a MSI. This button is the "New Task" button. Are there any other UI Action buttons that are supposed to take a MSI to the next state?
Thanks.
