Start a Sidebar chat in Security Incident Response

Using Sidebar, security analysts can collaborate with others in real-time based on a Workspace task-based or interaction-based record. These Sidebar discussions facilitate the exchange of information and knowledge to help resolve issues faster and with higher-quality outcomes.

Before you begin

Role required: sn_si.read

Verify that you have activated the Omni-Experience Standard Feature Set plugin. For more information, see Installing Sidebar.

Procedure

1. Navigate to Workspaces > Security Incident Response Workspace.
2. Select the List view icon.
3. Open a security incident for which you want to initiate a sidebar discussion.
4. Select Collaborate, and then select Start Chat.
   The Start a Sidebar discussion dialog box appears.

   Note:

   Sidebar's integration with Microsoft Teams enables Sidebar users and Microsoft Teams users to communicate with each other from their respective platforms. For more information, see Sidebar and Microsoft Teams.
5. On the Start a Sidebar discussion dialog box, fill in the fields.

   Field	Description
   Record number	The task or incident number associated with the Sidebar discussion.
   Subject	Provide a title for the sidebar discussion.
   Add participants	Option to add participants for the sidebar discussion. If you have integrated sidebar chat with Microsoft Teams, you can also add participants from Microsoft Teams. Note: You need to add at least one participant to create a new discussion. If Sidebar and Microsoft Teams are integrated, Microsoft Teams users are differentiated from Sidebar users with a Microsoft Teams icon. By default, all users who have read access to the SIR records will also have access to sidebar chats, but this can be controlled using member query. For more information, see Configuring Sidebar member query.
   Include a brief message	Provide a brief summary about the issue to be discussed in the sidebar discussion.

   Figure 1. Initiate a Sidebar chat in Security Incident Response

   

6. Select Start discussion.
7. You can perform additional configuration like quick actions.
   To limit the action usage, you can use the Apply to group field on the quick action page. For more information, see Creating a quick action.