---
sourceDocument: Yokohama Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/security-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Create incident response option rules

# Create incident response option rules {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

Create the incident response option rules that end user or analyst can use while responding to an incident.

## Before you begin

Role required:

* sn_dlir.admin - Create, edit, and delete.
* sn_dlir.analyst and sn_dlir.analyst_read - View (read-only).
{#configure-end-user-action__ul_i4v_zgh_h5b}

## About this task

You can configure the type of response that an end user should perform based on the type of DLP incident. The base system DLP Incident Response application provides the following response options for users:

* Assessment Complete
* Deleted Content
* Deleted File
* Encrypted File
* Masked Content
* Report false positive
* Report wrong owner
* Required for Business Process
* Reviewed Entitlements
{#configure-end-user-action__ul_jwb_kht_vsb}

For example, let's say that an end user reports a DLP incident as a false positive.
The state for this incident is then automatically marked as closed because the
target state that is configured by you is closed.

## Procedure

1. Navigate to AllDLP AdministrationIncident Response Option Rules.
2. Click New.
3. On the form, fill in the fields.  
   {#configure-end-user-action__table_vvq_l5k_zrb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name of the incident response option. |
   | Active | Option to indicate whether the incident response option is active. |
   | Execution order | Priority of the incident response option. This field indicates the order in which the incident response options are executed when two or more incident response options share the triggering conditions. The incident response option with the lowest number has the highest priority. To set the order of operation, enter a value. For example, 100, 200, or any other number. The default is 100. |
   | Description | Unique description for this incident response option. |
   | Default target state | The default target state that you configured. |
   | Condition | Conditions in the condition builder. These conditions are based on the DLP incident table. To build a condition for the incident response options, select any of the incident fields. Use the lists and fields of the conditions builder to set the filters for the first row. To add more conditions, click AND or OR: * If AND is selected, all conditions must be matched. * If OR is selected, either condition can be matched. {#configure-end-user-action__ul_e1n_xsg_zrb} To set a second filter condition, click New Criteria. Note: The conditions in the condition builder are case sensitive. |
   [Table 1. Incident Response Option Rules form]

   {#configure-end-user-action__table_vvq_l5k_zrb}  
   The following example shows the end-user action configuration for an endpoint. The condition requires the scan source to be an endpoint file system that then triggers this end-user action configuration. The mapping shows that the report wrong owner, report false positive, and deleted file are the response options available to the end user.Figure 1. Incident Response Option Rule
4. In the Response Option Mappings section, click New.
5. On the form, fill in the fields.  
   {#configure-end-user-action__table_wrk_qyk_zrb__entry__2}

   |   |   |
   |-|-|
   | Response Option Rule | Name of the incident response option rule. For example, <kbd class="ph userinput">SharePoint</kbd> implies that the scan source is SharePoint. You can either enter the name of the incident response or look up using search. |
   | Response Option | Option to select the response option. You can either enter the response option or look up using search. |
   | Target State | The target state of the DLP incident after the end user selects the appropriate action. Note: 1. The Target State field will appear only when you select Response Option which is of Type: Basic. For more information on how the target state types are configured, see [Configure response option for your DLP incidents](https://www.servicenow.com/docs/bMy63OZMfsT~evTa~gr96w "Use this feature to configure the type of response that an end user or analyst should perform."). 2. When a Response Option which is of Type: Advanced is selected, you will not be able to set the Target State and will be hidden. The Target State will be assigned based on the custom state that is configured from the flow designer sub flow. {#configure-end-user-action__ol_mvj_4cx_byb} |
   | Show response options for | Option to determine the user roles to show the response options for. You can choose from Analyst, End user, and Escalated Analyst Reviewers by using the unlock option. You are allowed to choose one or all the roles. |
   [Table 2. Response Option Mapping form]

   {#configure-end-user-action__table_wrk_qyk_zrb} Figure 2. Response Option Mapping Action
6. Click Submit.
**Related concepts**   

* [Monitor DLP Integration Run process](https://www.servicenow.com/docs/SEN6LY_8hKz6MD8ldIGuVA "Track and monitor the ongoing ingestion or the integration run process. The integration run processes contains the statistics on how much the data was processed and the integration status.")
* [DLP Incident Access Restrictions](https://www.servicenow.com/docs/9vlLhpUoXVMLbIOXaQG7AA "Manage the visibility of a particular DLP incident that contains sensitive information. You can use incident access restrictions to define who can access a particular DLP incident and restrict specific users or groups from accessing that incident.")  
**Related tasks**   

* [DLP default configuration settings](https://www.servicenow.com/docs/byIuJ~f0un4uAmDtYahOVg "Define the default configuration settings for Data Loss Prevention Incident Response (DLP IR) incidents to identify and set up the incident notification and incident assignment preferences for your end users.")
* [Create end user lookup rules](https://www.servicenow.com/docs/3~7V6tLXfDyGR9elDsMk1g "You can create and configure end user lookup rules and assign the DLP incidents to the respective end users based on those rules.")
* [Create assignment rules](https://www.servicenow.com/docs/4Nvihko2uI_cFDRh9j~dmA "Create assignment rules and assign the Data Loss Prevention Incident Response (DLP IR) incidents to user groups, end users, managers, or user from incident.")
* [Create incident consolidation rules](https://www.servicenow.com/docs/xDBI2oXVU7y3svnRnEIPdQ "Create incident consolidation rule to consolidate multiple incidents of similar nature under one parent incident.")
* [Create response due date rules](https://www.servicenow.com/docs/aGfuTB1~6JSqftIesOB6nQ "Set up the response due date rules to determine the time you want to give your end users to respond to the assigned Data Loss Prevention Incident Response (DLP IR) incidents.")
* [Create Approval Rules](https://www.servicenow.com/docs/LZuUVX4lLn79vagW0wH76w "Configure approval rules that require one or more approvers to authorize an advanced response option before it is applied to a DLP incident.")
* [Create user instructions templates](https://www.servicenow.com/docs/vVup03~8CFn_Aa~7NQVtsA "Create and manage user instructions template for DLP incidents to help the users understand the instructions involved incident resolution and the next steps involved in the resolution process.")
* [Create email templates](https://www.servicenow.com/docs/bQ7LBfNMV59D18ohgqIwSA "Create and manage the preconfigured email templates for sending notifications to your end users, user groups, or managers. With these templates, you can coach and communicate with your end users about the Data Loss Prevention Incident Response (DLP IR) incidents.")
* [Create a Data Loss Prevention Incident Response SLA trigger](https://www.servicenow.com/docs/4wU9FTaZr9_1sv5243aREA "Create a Data Loss Prevention Incident Response SLA trigger condition that enables a prompt and efficient response to an incident when triggered.")
* [Create a Data Loss Prevention Incident Response SLA definition](https://www.servicenow.com/docs/cvKsTbRENDm2pzvMYTabuw "Create a Data Loss Prevention Incident Response SLA definition that outlines the conditions and duration for responding to data breaches. Establishing clear expectations and protocols helps ensure a swift response to incidents, minimizing potential damage and enhancing overall data protection strategies.")
* [Create assessments](https://www.servicenow.com/docs/lUPlbqXTYbUc77Gzj_5H6w "Create and manage assessments to enable end users to respond to DLP incidents. You can use the assessments to gather information about the sensitive data exposed or leaked from the DLP incidents.")
* [Configure response option for your DLP incidents](https://www.servicenow.com/docs/bMy63OZMfsT~evTa~gr96w "Use this feature to configure the type of response that an end user or analyst should perform.")
* [Create age chart configurations](https://www.servicenow.com/docs/RA_omQ4xLGPRZmVdlTKDNQ "Configure the age chart that appears in the Data Loss Prevention Incident Response (DLP IR) Ops portal. This chart shows the count of open incidents by the number of days.")
* [Create user delegate configurations](https://www.servicenow.com/docs/K_Vasn65TCCHVPJcNBeOfg "Prevent certain executives in the organization from receiving notifications about the incidents assigned or escalated to them.")
* [Create repeat offender identification rules](https://www.servicenow.com/docs/74i8xF9eMAJi_vMs7dMX5Q "Create repeat offender identification rules to identify users who repeat the same issue multiple times.")
* [Create additional incident data fields](https://www.servicenow.com/docs/VqR5XYIMrGZ2_YWVpnDHug "Create Additional Incident Data Fields for the DLP incidents. You can create different types of fields such as string, number, check box, choice, date and time, and use them in the DLP incident forms.")
* [Configure advanced settings](https://www.servicenow.com/docs/66mwACGZCgPo22sR4rNoLA "Configure the advanced settings to customize the incident display and behavior. For example, enable displaying the sensitive data on an incident and its clone, or specifying fields on the incident to identify the end users. In addition, activate and customize the evidence files preview properties.")
* [DLP Incidents Archival](https://www.servicenow.com/docs/uvETPiXeLxWT6j7T3DlXmg "The Data Loss Prevention Incident Response is provisioned with one archival rule in the base system for the DLP incident table. The related records are also added in the base system to the DLP incident archive rule.")  
**Related reference**   

* [DLP SLA Definition form](https://www.servicenow.com/docs/vo6L6EU_uyk1GYSEqwadBw "Field descriptions for the DLP SLA Definition form used to create an SLA record.")

*[\>]: and then