Case/incident types
Review your organization’s policies for responding to events and then determine the basic categories of events. As a very simple example, you might want to have three categories: Malware, Intrusion, and Loss of Personal Information. You can create an incident type for each category.
Furthermore, you can create subcategories by creating a parent incident type with child incident types. For example, you might want to have three subcategories of Loss of Personal Information, such as Executive, HR, and Other.