Create an Incident or Change from a Security Event
When you follow up on a Security Event, you can create an Incident or Change directly from the Security Event for quick and easy tracking.
To create an Incident from a Security Event:
1.Log in as Administrator.
2.Open the Security Event from the Event workspace.
To locate the Event workspace, click More in the title bar. If the Event workspace does not appear in the My Workpace list, click the Search objects drop-down and select it from the list. You can also type "Event" into the field to locate it.
3.On the Action Menu, select Form Actions > Create Incident.
If a message displays stating that the Incident Owner and Team fields need to be entered, you'll need to complete those fields before you can save the record.
Select OK, and then select the Overview tab.
Select a Team and Owner, and then select Save.
The other fields autopopulate from the Overview tab.
To create a Change from a Security Event:
1.Log in as Administrator.
2.Open the Security Event from the Event workspace.
To locate the Event workspace, click More in the title bar. If the Event workspace does not appear in the My Workpace list, click the Search objects drop-down and select it from the list. You can also type "Event" into the field to locate it.
3.On the Action Menu, select Form Actions > Create Change.
The Change tab fields autopopulate from the Overview tab.
4.Select Save.