Handle a security incident
The case is handled, every reporting deadline is met, and the lessons are recorded.
- 1CommandIncidents
Know the difference between an investigation and an incident
A case is either an investigation or an incident:
Open this step → - 2CommandIncidents
Open an investigation or declare an incident
Who can do this: Incident responder and Admin.
Click Open investigation when you are still finding out what happened, or Declare new incident when you know it is an incident. You can switch between the two under Open as in the window.
Open this step → - 3CommandIncidents
Work on the case
Who can do this: Incident responder and Admin.
Open a case to see its workspace:
Open this step → - 4CommandIncidents
Start the reporting clocks
Who can do this: Incident responder and Admin.
You can start a clock at any point in the response, not only when you declare the incident.
Open this step → - 5CommandIncidents
Discuss the case with the assistant
In the side panel, under Actions, click Open in chat. Command opens Chat with a summary of the case (ID, title, severity, stage, systems, data, clocks and timeline) and the question "What are the next steps, and is anything overdue or…
Open this step → - 6CommandIncidents
Record the notification you submitted
Who can do this: Incident responder and Admin.
When you have notified an authority, record it on the clock.
Open this step → - 7CommandIncidents
Hold the post-incident review
When an incident reaches Lessons, the case shows a Post-incident review section.
Open this step → - 8CommandAudit log
Check the trail in the audit log
Click Audit log in the top navigation.
Open this step →