Create an Incident or Change from a Security Event

when you follow up on a security event, you can create an incident or change directly from the security event for quick and easy tracking to create an incident from a security event log in as administrator open the security event from the event workspace to locate the event workspace, click more in the title bar if the event workspace does not appear in the my workpace list, click the search objects drop down and select it from the list you can also type "event" into the field to locate it on the action menu , select form actions > create incident if a message displays stating that the incident owner and team fields need to be entered, you'll need to complete those fields before you can save the record a select ok , and then select the overview tab b select a team and owner , and then select save the other fields autopopulate from the overview tab to create a change from a security event log in as administrator open the security event from the event workspace to locate the event workspace, click more in the title bar if the event workspace does not appear in the my workpace list, click the search objects drop down and select it from the list you can also type "event" into the field to locate it on the action menu , select form actions > create change the change tab fields autopopulate from the overview tab select save