SIR Workspace Related Records

This section consists of the related lists items that are grouped into sections such as associated observables and configuration items.

The following related lists groups that are available as a part of the base system. You can modify these groups or create groups within the application and their respective actions.

You can modify these groups or create new groups. For more information, see Configure Security Incident Related List on how to configure and group the related list for security incidents and response tasks. Each related list is fully functional within the SIR Workspace.

Related list	Grouped item
Business Impact	Configuration Items Affected Users Related Configuration Items Related Users Affected Services
Threat Intel	Associated Observables Threat Lookup Results
Phishing	Associated Phish Emails Associated Phish Headers
Related Security Incidents	Parent Security Incident Child Security Incident Similar Security Incident
SLA Records	Task SLAs
Source Events/Alerts	Source events or alerts are the SIEM integration enabled related list such as Source Email, LogRhythm Drill Down Logs, LogRhythm Events, Aggregated IBM QRadar Offense and so on. Note: This list is completely dependent on the integration that you have in your instance. To view the relevant SIEM integration related list, you must install the latest version.
Sighting Search	Sightings Search Results Sightings Search Details Sighting
Observable Enrichment	Observable Enrichment Results Associated MISP Events MISP Enrichment Results
Endpoint Detection and Response (EDR)	Host Details Running Processes Running Services Logged On Users Network Statistics Get File Isolate Host Entries Additional Actions On Endpoint Microsoft Defender for Endpoint-Related Machines Details

Note:

In general, you'd be able to create new records, link, or unlink existing records or new records against the related list group as applicable.

Related concepts

• Set up view of SIR Records
• Configure SI design time investigation
• Configure Shift Handover
• Security Incident Response conference call integration
• Configure report templates in Security Incident Response
• On-Call scheduling in Security Incident Response
• Category management in Security Incident Response
• View and update Security Incident Response system properties
• Timeline in Security Incident Response Workspace

Related tasks

• Define the new Risk Score Calculator Rules
• Create quick filters for Security Incidents and Response Tasks lists
• Configure Security Incident Related List

Configure Security Incident Related List

You can add new related lists or new related list groups, and modify existing groups or related lists that appear in the SIR Workspace.

Before you begin

The security incident related list are grouped and displayed as group related list items on the Related Records tab on the workspace.

Role required: sn_si.admin

Procedure

1. In the classic UI, navigate to All > Security Incident > Show Open Incidents.
   
2. Select any incident record.
3. Right click on the incident context menu.
4. Go to Configure > Related List.

   

   The Configuring related lists on Security Incident form is displayed.
5. Go to View name and select New.
6. Enter a name for the view.
7. Select the newly created view.
   After you select the view, choose the required related list fields from the slush bucket.

   

   Note:

   If you want to modify anything, select the view and remove or add the items.
8. Click Save.
9. On the left navigation, navigate to All > Now Experience Framework > Experiences.
10. Select Security Incident Response Workspace.

    

    The UX Application Security Incident Response Workspace page is displayed.
11. Go to UX Page Properties tab and select relatedListLayoutConfig option in the list view.
    

    

12. Add the newly created view name separated by a comma to an already existing list of values in the Value text box under the sn_si_incident.viewsUsedForGrouping field.
    For example, if you had created a new view name as, Business Impact then in the Value text box you must specify it as business_impact (which is separated by underscore within the view name and separated by a comma after an existing value) under the sn_si_incident:groups field.

    

    Note:

    If you add the new view name under sn_si_incident.viewsUsedForGrouping field then the entry will be created in the Related Records tab of the workspace.

    If you update the view name entry in si_other_records.viewsUsedForGrouping then the related list group will get added in the Other Records tab of the workspace.

    Below is an example view which shows the newly created views added.

    

    Note:

    requiredRolesForGrouping contains comma separated sys_user_role record names. SIR Workspace user should have at least one of these roles, to use the grouped related lists. When a user does not have any of these roles then related lists view configured for the current user role using view rule configuration will be represented vertically without grouping. This property is ignored when isGrouped property is set to false. If this property is empty any user can access the grouped related lists.
13. Click Save.
14. Navigate to Workspaces > Security Incident Response Workspace.
15. Select any specific security incident.
16. Go to Related Records tab of the workspace.
    The grouped related lists are displayed.

Configure Response Task Related List

Use this section to configure response tasks new related lists that appears on the Security Incident Response application.

Before you begin

Role required: sn_si.admin

About this task

The response tasks related list is not grouped but displayed as individual related list items, as there are few default lists. View the response tasks related items from the Response Tasks tab of the security incident record of the workspace.

Procedure

1. Navigate to All > Security Incident > Response Tasks > Show All Tasks.

   

2. Select any response task record.
3. Select and hold (or right-click) the Security Incident Response Task context menu.
4. Navigate to Configure > Related List.
   The Configuring related lists on Security Response Task form is displayed.
5. Go to View name and select sirw view.

   

6. Select the desired related list fields from the slush bucket.
   For example, Affected Locations.

   

7. Select Save.
8. Navigate to Workspaces > Security Incident Response Workspace > Response Tasks.
   The configured related lists (For example, Affected Users as selected) is listed within the Related Records list.