Incidents

Part ofHandle a security incident

The Incidents page is where you record and handle security events, from the first suspicious signal to the lessons learned. This page explains how to open an investigation, declare an incident, move it through its stages, keep track of reporting deadlines and export a post-incident review.

Who uses it

Role	What they do here
Incident responder	Opens investigations, declares and handles incidents, and runs reporting clocks
Admin	The same as an Incident responder
Auditor and Policy editor	Read cases, their timelines and their clocks

Buttons are not hidden by role. When your role does not allow a change, Command shows Declare failed or Update failed.

Before you begin

Agree in advance who decides that an event is an incident, and which authorities you report to. Command keeps the clocks and the record; it does not decide which obligations apply to you.

Investigations and incidents

A case is either an investigation or an incident:

An Investigation means "We are looking into a signal." No reporting clocks run for an investigation. It moves through the stages Intake, Analysis and Decision. You either promote it to an incident or close it without one.

An Incident is a confirmed incident; reporting obligations may apply. It moves through Triage, Contain, Eradicate, Recover and Lessons. Reaching Lessons resolves it.

Each case has a case ID that starts with INV- for an investigation or INC- for an incident.

Reporting clocks

A reporting clock counts down to a notification deadline. Command offers preset clocks named after the notification deadlines in NIS2, GDPR and DORA, with windows from 4 hours to one month, and a custom clock with your own label and window. Only incidents have clocks.

Clock status	Meaning
On track	The deadline is more than 12 hours away
Approaching	Less than 12 hours left
Overdue	The deadline has passed: Past deadline — submit immediately
Submitted	You recorded that the notification was submitted
Cancelled	The obligation turned out not to apply

Command does not send alerts about deadlines. Watch the clocks on the Incidents page and on the Dashboard.

The Incidents page

Click Incidents in the top navigation.

The list on the left, Cases, has four filters: Investigations and Incidents (active cases only), Resolved and All.

Each case shows its ID, whether it is an Investigation or Incident, its severity (Low, Medium, High or Critical), its title, its stage, and its next reporting deadline, Resolved or No active reporting clocks.

Search incidents… finds a case by title or ID.

Deadlines more than two days away show days and hours; closer deadlines count down in hours, minutes and seconds. They turn amber when less than 12 hours are left and red when overdue.

The Incidents page with a list of cases and their reporting deadlines

Click a case to open it.

Open an investigation or declare an incident

Who can do thisIncident responder and Admin.

Click Open investigation when you are still finding out what happened, or Declare new incident when you know it is an incident. You can switch between the two under Open as in the window.

Under What happened?, describe the event in a line. This is required.

Choose a Category: Data breach, Malware / ransomware, Phishing, Account compromise, Availability / DDoS or Third-party / supply.

Choose the Severity: Low, Medium, High or Critical.

Under Detected, choose when you became aware: Just now, Within the last hour, Earlier today or Yesterday. Command records the earliest moment of the period you choose, for example the start of yesterday, as when you became aware. The reporting clocks run from that moment.

Under Affected assets, click Couple affected asset and pick each affected asset.

Optionally, add Initial notes: what you know so far and any containment already taken.

Tick Personal data may be affected if that is the case.

Check the clock preview at the bottom, and click Open investigation or Declare incident.

Command creates the case, opens it, and shows its ID followed by opened for investigation or declared.

When you declare a High or Critical incident, Command starts the NIS2 early-warning and incident-notification clocks straight away, and also the GDPR clock when you ticked Personal data may be affected. The preview in the window shows which clocks will start. These are presets to help you, not legal advice: cancel any clock that does not apply to you, and start any other you need.

Work on a case

Open a case to see its workspace:

The header with the case ID, phase, severity, Active or Resolved, the title, how long ago you became aware, how many systems are affected and the next deadline.

The stage bar, showing where the case is.

The reporting clocks, for incidents.

The timeline, newest first: every stage change, decision and clock, with who did it and when.

The side panel with Affected systems, Linked assets, Affected data and Actions. Click a linked asset to open it on the Assets page.

An incident open with its stages, reporting clocks and timeline

Every change needs an explanation

Every change of state asks you to explain it in at least 10 characters. Until you have written enough, the window shows how many more characters are needed. Your explanation is written to the timeline, so the record shows not only what changed but why.

Who can do thisIncident responder and Admin.

Button	When you see it	What it does
Advance to followed by the next stage	An active case that is not at its last stage	Moves the case to the next stage. Advancing an incident to Lessons resolves it.
Promote to incident	An active investigation	Turns it into a declared incident at Triage. Reporting clocks become available; none start by themselves, so start the ones that apply straight after.
Close — no incident	An active investigation	Closes it with your conclusion. The case stays on record; nothing is deleted.
Start reporting clock	An active incident	Starts a clock. See below.
Mark resolved	An active incident	Resolves the incident. If clocks are still open, the window warns you: resolving does not submit them.
Reopen	A resolved case	Returns the case to active response. The original closing entry stays on the timeline.

To jump to another stage out of order, click it in the stage bar. Command asks you to explain why: Out-of-order stage changes stand out at review — say why here.

Handle an incident from start to finish

Open the case.

Click Advance to the next stage, write your explanation, for example "Malicious account disabled and sessions revoked", and confirm.

Repeat for each stage as the response progresses.

When the incident is over, click Mark resolved, explain what makes it resolved, and click Mark resolved in the window. Command shows Incident resolved.

If it turns out the incident is not over, click Reopen, explain why, and click Reopen case. Command shows Reopened.

Watch: resolving and reopening an incident (about 1 min)

Start and cancel reporting clocks

You can start a clock at any point in the response, not only when you declare the incident.

Who can do thisIncident responder and Admin.

In an active incident, click Start reporting clock.

Under Obligation, choose a preset clock, each showing its window, or Custom clock for any other notification deadline. A clock that is already running cannot be chosen twice.

For a custom clock, enter a Clock label, for example "Sector regulator — initial notification", and the Window (hours).

Under Runs from, choose When we became aware or Now. The window shows the resulting deadline, and already past due when it has passed.

Click Start clock. Command shows the clock's name followed by started.

To cancel a clock because the obligation does not apply, click Cancel on the clock, explain why, and click Cancel clock. Use this only when the obligation does not apply, not to silence a deadline you still owe. The clock stays visible as Cancelled.

Record a notification you submitted

When you have notified an authority, record it on the clock.

Who can do thisIncident responder and Admin.

On the clock, click Submit notification.

Check the Regulator. Command fills in a default for the clock; change it to the authority you notified.

Check the Subject and Body. Command fills them in from the case details; edit them so they match what you sent.

Tick I have reviewed this notification. The CISO or a designated delegate has approved it for submission.

Click Submit to followed by the authority. The clock is marked Submitted, the text is stored with the case, and the timeline records it.

Note

Command does not send the notification to the authority for you. Send it through the authority's own channel, and record it here.

After the first notification, the case shows the stored text under Regulator notification draft. Click Edit draft to correct it, and Save changes.

Discuss a case with the assistant

In the side panel, under Actions, click Open in chat. Command opens Chat with a summary of the case (ID, title, severity, stage, systems, data, clocks and timeline) and the question "What are the next steps, and is anything overdue or missing?" in the message box. Edit it if you like, and send it. See Chat and assistants.

Post-incident review

When an incident reaches Lessons, the case shows a Post-incident review section.

Draft corrective control opens the Controls page with a new control titled "Prevent recurrence:" followed by the incident title, tied to the affected assets, and drafts its text from the facts of the case. Review it and save it. This needs the Admin role. See Controls.

Export review downloads the review as a Markdown file named after the case ID, with the title, severity, status, stage, detection time, the timeline and the notifications you recorded. Command shows Post-incident review exported.

How Command protects you

Every change of state needs a written explanation, which is kept on the timeline.

Closing an investigation keeps it on record; there is no way to delete a case.

Reporting clocks never start for an investigation.

Resolving an incident does not silently close its open clocks; Command warns you.

Cancelling a clock needs a reason, and the cancelled clock stays visible.

Recording a notification needs your confirmation that it was reviewed and approved.

Declaring and resolving incidents are recorded in the Audit log.

Troubleshooting

What you see	What it means	What to do
Declare failed	The case could not be created, for example because your role does not allow it	Ask an Incident responder or Admin
Update failed	A change to the case was refused	Check your role and try again
The confirm button stays disabled, with more characters needed	Your explanation is shorter than 10 characters	Explain the change in a full sentence
Could not start the clock	The clock could not be started	Try again. Check your role.
All notifications already submitted	Every clock on the case is already submitted	No action needed
No {filter} incidents.	The chosen filter has no cases	Choose All
Download failed	The review could not be exported	Try Export review again

← PreviousAssets Next →Chat and assistants