Propose as a Major Security Incident

  • Release version: Washingtondc
  • Updated February 1, 2024
  • 1 minute to read

    • Propose a security incident to a major security incident.

    Before you begin

    Role required: sn_si.analyst

    Procedure

    1. Navigate to Workspaces > Security Incident Response Workspace > Security Incidents > Lists.
    2. Select the security incident in the related category that you want to propose as a major security incident.
    3. Select the More Actions icon and select Propose as Major Security Incident.
    4. In the Propose as Major Security Incident dialog box, fill in the fields.
      1. Detection Date: Date when the major security incident was first created or proposed.
      2. Justification: Provide the justification for proposing the incident.
      3. Potential impact: Indicate the impact of the incident.
    5. Select Propose.

    Result

    The incident is proposed and the following actions occur:

    • In the security incident record, a verification banner message is displayed and the defined Major Security Incident tag appears.

    • The record appears in the Major Security Incident related list in the incident record, with the state listed as Proposed, and in the MSIM Workspace Candidates list.

    • The Activity section in the MSIM Workspace shows that the security incident has been proposed to be promoted as a major security incident.

    • A message is sent to those in the defined notification list that contains a link to the incident record and the Details tab for the incident.