Working with Security Incident Records

The Security Incident Record consists of the following.

Key components available on a security incident record:

Figure 1. Key components of a security incident

Number	Name	Description
1	Security incident number	The security incident number is available against the tab name.
2	Short description	Short description of the security incident which is displayed above the form banner.
3	Form banner	This is read-only section, which contains the key fields such as Category, Priority, Risk score, State, and the incident assignment details. Note: The regular platform tags can be applied here as well.
4	Security tags	Displays the security tags associated with a security incident.
5	Overview	Provides a snapshot overview of the security incident such as Description, Business Impact comprising of asset details by type, affected users by criticality, Threat intelligence items comprising of observables by finding and by type, Response Tasks, Related security incidents comprising of child security incidents and similar security incidents.
6	Details	The details tab displays the security incident form.
7	Investigation	The Investigation tab displays the incident investigation experience.
8	Playbook	Playbook is triggered through Process Automation Designer (PAD). If a process is created, and if the a trigger condition is set to trigger the playbook for a security incident. Then a playbook appears.
9	Response Tasks	The Response Tasks captures all the response tasks associated with a security incident.
10	Related Records	The Related Records tab consists of all the related lists from the classic UI under this section. The related lists are grouped under various section such as business impact, threat intel, and so on for an easy navigation.
11	Other Records	Other records tab consists of IT records such as changes requests, incidents, and emails grouped and displayed in this section.
12	Post Incident Review tab	As the security incident progresses to the Review state, the Post Incident Review tab is displayed with the post incident assessments and reports within the tab.
13	Contextual menu	Provides easy access to the quick actions and is available across all the tabs for the analyst to access whenever required. The contextual menu provides easy navigation to the multiple resources such as: Activity Stream Playbook Analyst Assist Runbook Templates Attachments
14	Form UI actions	The various security incident form UI actions are displayed on the top right of the incident form. The available form UI actions are: Discuss Save Create Response Task Compose Email Add Playbook Open Associated Workflow(s) Crete incident Create Problem Create Change Request Create Outage Calculate Severity Link to Major Security Incident Propose as Major Security Incident Promote to Major Security Incident Run Additional Action(s) on Endpoint Associate MITRE ATT&CK Technique Switch to Classic UI Add to Security Case Delete For more information, see Working with Form UI actions.

• Security Incident Overview section
  The Overview section on the workspace presents the key information associated with the security incident.
• Security Incident Details section
  This section displays the security incident form fields that are rendered from the security incident classic UI.
• SIR Workspace Orchestration
  Security Incident Response Workspace orchestration activities will help the security analysts to view the investigation canvas and perform various actions that are applicable.
• Security Incident Response Tasks
  All the response tasks associated with a security incident are displayed within the Response Tasks section.
• Security Incident Response Other Records
  This section displays the other records such as IT related records and email records. Under IT records, Incident, Change Request, Problem and Outages are displayed.
• Security Incident Response Post Incident Review
  Post incident review appears when an incident is moved to a Review state.
• TISC integration within SIR Workspace
  TISC integration with SIR automatically shares the context on the observables within the security Incident workspace and observables.
• Reports in Security Incident Response
  All the reports associated with a security incident are available within the Reports section for analysis and sharing.
• Collaborate using conference call or chat in Security Incident Response
  You can collaborate with analysts and affected users to resolve or discuss about an incident in Security Incident Response application.
• Viewing incident details with a relationship graph
  Relationship graphs in the Security Incident Response workspace visually display the connections between a security incident and its related items to help you analyze the full context of a security incident.

Related concepts

• Security Incident Playbook
• Prerequisites for the Playbooks
• Rebuilding existing playbooks in Workflow Studio
• Activity Definitions
• Sample Playbooks for SIR Workspace
• Working with MSI Records
• Working with Form UI actions

Related tasks

• Security Incident Closure workflow