Security Incidents
All security related incidents for the organization such as data breach, policy violation, phishing, and theft can be reported using Security Incidents.
Security Incidents may also be created automatically as a result of importing data from RBVM using the RBVM Connector. Refer to Configure the RBVM Data Import Connector to Import RBVM Events. You can edit these security incidents if required by opening them from the Security Incidents workspace.
Creating a Security Incident
- Open the Security Incidents workspace.
- Click New and either select a template or select Create a New Record.
- Enter information into the fields:
- Summary and Description.
- Category - Based on the category, a relevant workflow is applied and initiated. Select the Workflow Instance tab to view the workflow. You can abort or pause the workflow and resume it when paused.
- If the Security Incident involves sensitive data - select the Is Sensitive Data Lost/Stolen? or Sensitive Data Breach checkbox. The checkbox displayed is based on the incident category.
- If the Security Incident is a phishing attack, select the Phishing Attack? checkbox. The checkbox is displayed only when the Category is Phishing.
- Click Save.
Tabs in Security Incidents
If you do not see some of the tabs listed here, they may be hidden, click the 
icon at the right corner of the tabs list and select the tab you wish to reveal.
- Task - Based on the workflow, tasks are automatically added to the Security Incident. You have to complete the tasks to resolve the incident. Additionally, you can add more tasks as required.
Other actions you can perform for Tasks are - Accept, Reject, Cancel, Reassign, Waiting, Continue, and Complete.
- Confidential Participants
This tab is available only when you select the Confidential checkbox.
You can limit access to the Security Incident to selected users by adding Confidential Participants.
- Events - Link events to the Security Incident. On linking an Event, a Child Security Incident can be created. To view existing child incidents, or to create one, click the Child Security Incidents tab.
- Child Security Incidents - Link existing incident or create new incident as a child incident to the Security Incident.
- CI - Link the Configuration Item that is lost, stolen, or involved in any other way to the Security Incident.
- Problem - Create a new problem or link existing problem to the Security Incident.
- Change - Create a new change or link existing change to the Security Incident.
- Contract - Link contracts to the Security Incident.
- Activity History - The history of all emails is displayed here. Includes emails you've sent to users, as well as system-generated emails.
- Checklist - Create new checklists or link existing checklists for the Security Incident.
- External Task - Create tasks or link existing tasks to the Security Incident that needs to completed by an external team.
- Attachment - Attach files or add URLs.
- Cost Item - The cost of the Security Incident is managed in this tab. You can either add cost item from the existing list or create a new cost item.
- Knowledge - Create knowledge articles or link existing article to the Security Incident for reference.
- Escalation Watch - All escalations records are displayed.
- Audit History - Displays the important changes made to the Security Incident such as when the Summary or Description is modified, and when the Status is updated.
- Workflow Instance - Displays the workflow used for Security Incident. You can Abort, Pause, and Resume the workflow.
- Approval - Create new or link existing approvals to the Security Incident.
- Related Posts - Link or unlink related posts to the Security Operations.