View related items for a security incident

You can view related items, such as similar and child security incidents, related users, vulnerability groups, and vulnerable items associated with a security incident.

Before you begin

Role required: sn_si.basic

Procedure

1. If it is not already open, open the security incident for which you want to view related items.
2. Click the Show Related Items related link.
3. Click any of the related lists to view or add information for the security incident.

   Tab	Description
   Child Security Incidents	Select a task record related to the issue that caused this security incident to be created.
   Similar Security Incidents	View any other security incidents associated with any of the same observable records.
   Related Configuration Items	Displays a list of security incidents containing configuration items with the same observable as this security incident. This list can be filtered using the CI exclusions filter group. When an observable is added to a security incident this list is automatically updated. By default, observables with a context type of Destination are excluded.
   Related Users	Displays a list of security incidents containing users with the same observables as this security incident. This list can be filtered using the User exclusion filter group. When an observable is added to a security incident this list is automatically updated. By default, observables with a context type of Destination are excluded.
   Related Filter Group	After configuration items are identified, any matching CI or Filter group are automatically added.
   Vulnerability Groups	If Vulnerability Response is activated, you can view vulnerability groups associated with this security incident.
   Vulnerable Items	If Vulnerability Response is activated, you can view vulnerability items associated with this security incident.
   Risks	If any of the core Risk Management plugins (Policy and Compliance Management, Audit, Management, or Risk Management) are activated, you can view or add risks associated with the security incident. You can add this related list from the form header context menu under Configure > Related Lists.
   Configuration item events	If Event Management is activated, you can view events.
   Configuration item alerts	If Event Management is activated, you can view alerts.
   Customer Service Cases	If Customer Service is activated, you can view Customer Service case information.

4. Click any of the following related links to further update the security incident:
   • Show Affected Items
   • Show IoC
   • Show Enrichment Data
   • Show Response Tasks
5. When you have completed your entries, click Submit.