Security Incident Response manual assignment

[joel_tan1991]

How do I remove the assignment group which was assigned automatically upon submit?

I have set the assignment rule to "Manually" for the requests.

Upon creating and submitting while leaving the assignment group blank, it will be automatically populated with the value "SIRT". The SIR tasks work just fine (Assignment group and Assigned to remains blank upon creation). 

Are there any place which I'll need to configure to prevent this auto-assigning of assignment group?

Thank you

[joel_tan1991]

I have looked through the system property, business rule and client scripts but found nothing. The transition upon creation was smooth as there was no double update. The assignment group was only populated after clicking save/submit on a new form.

I went ahead to test out an inbound action to create a new response. The assignment group was populated as well.

I've looked through the sm_order table for any related scripts or rules which might affect it but wasn't able to obtain any. I can't find anything that references to the assignment group's sys_id.

Am I missing out on something?

[andy_ojha · Accepted solution]

Hi Joel,

There is an Assignment Rule here on the <sn_si_incident> table that needs to be modified.  It is called "SIRT Assignment" - refer to screenshot.

If you change this Assignment Rule to Active = False, you'll achieve the behaviour you are looking for on manual SIR creation.

[joel_tan1991]

Yes! This is exactly what I'm looking for. Thank you!