Unlink records from Major Security Incident

Using the Major Security Incident Management workspace, unlink the major security incident records from the Linked Records section.

시작하기 전에

Role required: sn_msi.workspace_manager and sn_msi.workspace_responder

주:

You can only unlink a single record at a time. After you unlink a record, the related rolled up information will be removed from the Incident Impact and Threat Intelligence sections on the workspace and the action can't be undone.

For more information on roll up records, see Rollup Framework for MSIM.

프로시저

1. Navigate to Major Security Incident Response > MSIM Workspace.
2. Navigate to Lists view, which is displayed in the left pane of the workspace.
3. Click Accepted to select the promoted major security incident records.
4. Click the Linked Records tab.
   This section displays the linked records and its related records, which are linked to the Major Security Incident.
5. Select the desired table view such as Security Incidents, Remediation Tasks (vulnerable items), or Security Case.
6. Select the record to unlink from the list view of records.
7. Click Unlink Record.

   그림 1. Unlink Record

   

8. A warning message is displayed asking if you want to unlink the selected record from MSI.

   그림 2. Unlink Record Warning Message

   

9. Click Unlink Record.
   The record is unlinked and once unlinked, the changes can't be reverted. The list view of Linked Records will be refreshed after unlinking.

관련 개념

• Propose, promote, and link incident records
• View Major Security Incident impact metrics
• View Major Security Incident trend charts
• Update Major Security Incident details
• Manage tasks in a Major Security Incident
• Track collaboration activity via MSIM workspace
• Configure Linked Records in Major Security Incident Management
• Configure Rollup Records in Major Security Incident Management

관련 태스크

• Using MSI List view in the MSIM workspace
• Link additional records to Major Security Incident
• Create and distribute MSIM Status Reports