View Major Security Incident impact metrics

Provides up-to-date summary reporting of the impact and progress of major security incidents, which is an important aspect of managing a major security incident using the new workspace.

The Overview tab provides the relevant metrics to manage both the scope and progress of the incident, including a rollup of affected assets, users, locations, and team resources, as well as the timeline of significant incident milestones.

Timeline provides a horizontal view of key events and milestones that have occurred as part of the specific major security incident resolution. The timeline component is displayed on top of all the Major Security Incident Management workspace tabs with an ability to collapse and expand for viewing as required. The events data represented will be updated and refreshed whenever designated milestone events or milestones are added or updated.

Each event or milestone is indicated with a different timeline event type option to identify the number and type of events or milestones. For example NOW record updates, collaboration activities. In addition, the time range period for the different major security incident states is tracked automatically and displayed using color-coded ranges displayed along with the duration of each incident state.

Figure 1. MSIM Overview tab

Table 1. Executive Summary and Incident Impact

Task	Description
Executive Summary	A brief summary of the major security incident along with the user name, user role, and timestamp details. You can modify the Executive Summary by selecting the Edit icon. After you make the required changes, select the Update option. To copy the Executive Summary and paste it to a major security incident, select the Copy icon and paste the summary to the required major security incident.
Incident Impact	These components display the impacted resources based on a rollup of all active tasks and linked incidents with identified assets, users, locations, and assigned team members. The impacted resources are: Affected assets Affected users Affected locations Selecting the number values enables you to drill down and navigate to the impacted assets, users, and location details and displays the related tasks on the Incident Impact tab of the workspace. Based on your selected incident impact type link, the related incident details such as task type and its description, assignment group and incident state are displayed in the Incident Impact tab of the MSIM workspace.
Duration counters	These components display the duration of the major security incident. The impacted resources are: Time elapsed: Displays the time elapsed from the time that the major security incident is detected. Estimated resolution date: Displays the estimated resolution date by when the major security incident is estimated to be resolved. Next update on: The date and time of the next update for resolving the major security incident. For example, 5:00 pm EST on March 25, 2024. You can modify the Next update on by selecting the Edit icon. Select the new date and time, and select Update.

You can enable or disable viewing of certain event types for both timeline indicators and timeline ranges accordingly using the filter toggle buttons.

Figure 2. Timeline

Refer to the following table for additional capabilities available with the timeline component.

Table 2. Timeline component additional capabilities

Task	Description
New Event	Creates new custom events and associates these events to the MSI record. This helps in creating events for both past and future dates that might not otherwise get captured via a labeled task, record state change, or labeled collaboration activity, which are displayed by default on the timeline.
Refresh	Refreshes the Timeline events to display the latest updates.
Timeline Indicators	Lists the various types of events such as Now Record field changes, Labeled Collaboration Activities, and Other (custom), along with the icons and total number of events that occurred with respect to each event type indicator. The slide indicator enables you to enable or disable all events for a specific event type.
Show Legend	Select to display the drop-down legend with different types of timeline indicators.
Timeline progress bar	Displays the overall progress of the incident via designated timeline events or milestones that are occurred within the different timeline ranges displayed. You can also link an Event type to an Event category. After you link it, the Event details get updated at both places on the timeline.
Timeline ranges	Displays various incidents state types and duration as the incident progresses throughout the full major security incident life-cycle. Enable or disable a specific event based on the incident state.

Create a Timeline event

To create a new Timeline event, perform the following steps:

1. In the Overview tab, navigate to the Timeline section.
2. Select + New event.
3. On the Add a new timeline event pop-up, fill the fields.

   Figure 3. New Timeline event

   

   Task	Description
   Title	Enter the title for the timeline event.
   Category	Select a category for the timeline event. The following categories are provided as a part of the base system, and you can choose one based on your requirements. Custom. Response. Threat. To add or configure a Timeline event category, see Configure timeline categories for major security incidents.
   Timestamp	Select the date and time of the timeline event using the Timestamp calendar. You can add events to the Timeline before and after the start date.
   Description	Provide a brief description about the timeline event.
   Linked to	Option to link the timeline event to a major security incident record.

4. Select Create.
5. You can use Zoom in and Zoom out icons to zoom in or out on the timeline progress bar, which includes displaying individual events when numbers are displayed to represent several events in close time proximity.

   You can also add the default zoom level to show all events.

6. Select the Refresh icon to display the latest timeline events.

Related concepts

• Propose, promote, and link incident records
• View Major Security Incident trend charts
• Update Major Security Incident details
• Manage tasks in a Major Security Incident
• Track collaboration activity via MSIM workspace

Related tasks

• Using MSI List view in the MSIM workspace
• Link additional records to Major Security Incident
• Unlink records from Major Security Incident
• Create and distribute MSIM Status Reports