SIR moves to “Contain” when Response Tasks go “Work in Progress” — how to stop this?
when Response Tasks go to Work in Progress, the parent Security Incident automatically changes to Contain.We don’t want this behavior, and I found no Business Rule doing it.Where is this roll‑up coming from and how can I disable it?
