The Admin can define and configure different Shift Handover templates for the Shift Owner to create shift handover records and hand them over to the next shift team.

Before you begin

Role required:
  • sn_escm_sh.shift_admin
  • sn_si.admin inherits the sn_escm_sh.shift_admin role

About this task

To configure a Shift Handover template, the Admin either creates a new Shift Handover template or opens an existing template in the base system with the name Sample Shift Template and modifies the details and sections according to your requirements.

The Shift Owner can use the configured template to create Shift Handover log records, and then the Shift Handover report is shared with the next active Shift Owner and team.
Note: Only the active Shift Handover templates are visible for the Shift Owner to create handover log records.

Procedure

  1. Navigate to Workspaces > Security Incident Response Workspace > Administration.
  2. Navigate to Shift Handover > Template Configurations.
    The Template Configurations page is displayed.
    Note: As a part of the base system, you’re provided with one predefined Shift Handover template configuration to view, edit, or modify the shift handover template. However, you can’t create or delete the predefined Shift Handover template configuration.
    Figure 1. Shift Handover Template Configurations
    Shift Handover Template Configurations
  3. To create a new Shift Handover template, select New.
  4. On the Details form, fill the fields.
    Table 1. Create a new Shift Handover template
    Field Description
    Name Name of the Shift Handover template. For example, SIR Template.
    Application Name of the application for which you’re creating the Shift Handover template. For example, Security Incident Response Workspace.
    Active Option to indicate whether the Shift Handover template is active. Enable this option to activate the Shift Handover template.
    Description Description of the Shift Handover template.
    Record mention configuration Use this field to configure the Rich Text Editor's (RTE) record mention details. The input is an array of JSON objects with the following fields:
    • sourceTable: Name of the source table.
    • label: Name of the label to be displayed.
    • filterCondition: Encoded query for filtering.

      You can add multiple queries for the same table to retrieve the values dynamically. These value are updated when the shift handover record is published or based on the shift's start date or/and end date. For example, count of security incident records by priority, count of security incident records by state.

      You can use the {start_date} and {end_date} arguments in the query for specifying a date range. For example, "filterCondition": "active=true^sys_created_on>=${start_date}^sys_created_on<=${end_date}"

    • fields: Select the fields to query the pattern.

    Sample configuration that you can copy and paste in the Record mention configuration field.

    [
    {
        "sourceTable": "incident",
        "label": "Incidents active",
        "filterCondition": "active=true",
        "fields": [
            "number"
        ]
    }
{
        "sourceTable": "incident",
        "label": "Active incidents created after selected date",
        "filterCondition": "active=true^sys_created_on>=${start_date}",
        "fields": [
            "number"
        ]
    }
]

    To copy the sample configuration, use the Copy to clipboard action in the Contextual Assistance pane. Then, you can make any additional modifications based on your requirements.
    Template Create a Shift Handover template using sections. Make sure that there is at least one section for the analysts to be able to contribute to the shift handover log records based on the template.
    The template can have static text, images, and so on, in the appropriate sections. You can copy and paste images directly in the Template field. You can create sections in the template using the following code:
    ${section:Section Label}
    Example: 
    ${section:Key Incidents/Events During Current Shift}
${section:Incidents/Events to Monitor or Follow Up}
${section:System/Infrastructure Updates}
${section:Next Steps for Incoming Shift}
${section:References}
    Note: For more information, refer to the Contextual Assistance on the right-pane.
  5. To use and modify an existing Shift Handover template, select Sample Shift Template.
    Figure 2. Shift Handover template
    Create a new Shift Handover template
  6. Update the Shift Handover template according to your requirements.
  7. Select Preview to view the runtime preview of the Shift Handover template.

    The report generates a preview based on the Shift Handover template configuration.

    Figure 3. Preview of the Shift Handover template
    Preview of the Shift Handover template
  8. Select Save to save the Shift Handover template.

What to do next

To learn how to Manage Shift Handover records in the list view and perform actions like create, edit, copy, or delete Shift Handover records, see Manage Shift Handover records.