View affected items for a security incident
You can view affected items, such as CIs, affected users, unmatched affected users, and affected services associated with a security incident.
Avant de commencer
Role required: sn_si.basic
Procédure
- Navigate to Workspaces > Security Incident Response Workspace.
- Open the security incident for which you want to view affected items.
- Select the Related Records tab.
- Select Business Impact.
-
Select any of the related lists to view or add information for the security incident.
Tab Description Configuration Items Affected configuration items (CI). After affected CIs are identified, you can manually add affected resources from this related list. Affected Users After affected users are identified, you can manually add affected users from this related list. Affected Services View or add business services associated with the security incident. Remarque :If an affected CI is added after the security incident is opened, select and hold (or right-click) in the form header and select Refresh Impacted Services.Unmatched Affected Users View or add the users who are affected by a security incident but cannot be matched to existing user records in the Users [sys_user] table. Remarque :If the Security Operations Integration - Get Running Processes integration capability is active, and you add a CI to a security incident, the Get Running Processes workflow runs and retrieves a list of running processes on the CI.If the Security Operations Integration - Isolate Host integration capability is active, you can select one or more CIs and restrict their system connections to other devices. To do this, select the check boxes for the CIs and select Isolate Host from the Actions on selected rows choice list.
- Selected any of the following related links to further update the security incident:
- When you have completed your entries, select Save.