Edit Related Records in list view

Edit related records for a security incident directly from the Related Records list view. This allows security analysts to quickly update the records without leaving their current context.

Before you begin

Use cases:

• Analyst can update the severity and confidence levels of multiple IP address observables directly within the incident workspace.
• Analyst can manage multiple findings by updating status and assignee inline from the workspace view. This enhances SOC team coordination during active investigations.
• Analyst can enrich observables with updated descriptions and attributes as new information becomes available instantly.

Limitations:

• Complex field dependencies may still require accessing the full form for accurate updates.
• Certain advanced field types, such as Modified, are not supported for inline editing.
• Bulk editing is restricted for non-compatible field types and logically grouped items.

Note:

The following are the example steps for updating the associated observables records of a security incident. You can refer this to update any record in the Related Records tab.

Role required: sn_si.analyst

Procedure

1. Navigate to Workspaces > Security Incident Response Workspace.
2. Open a security incident.
3. Select the Related Records tab.
4. Select Threat Intel and then select Associated Observables.
5. Select the fields to update.
6. Update the value of the fields as required.

Result

The updated field values are saved.

Related concepts

• Security Incident Overview section
• Security Incident Details section
• SIR Workspace Orchestration
• Security Incident Response Tasks
• Security Incident Response Other Records
• Security Incident Response Post Incident Review
• TISC integration within SIR Workspace
• Reports in Security Incident Response
• Collaborate using conference call or chat in Security Incident Response
• Viewing incident details with a relationship graph
• MITRE attack and defend technique graph