You use phases to define each stage of an incident response, essentially capturing the general intent of the response action.

The Phases feature logically and visually organizes tasks. For example, you might define the following phases in an incident response plan: Initial, Engage, Decision: Escalate or Mobilize, Containment, Remediate, and Complete.

Each phase has its own list of tasks. Tasks in the next phase are not exposed until the phase completes. You can also define the order of the tasks in each phase so that the tasks can be performed sequentially. When completed, the playbook moves to the next phase and assigns its list of tasks accordingly. Based on data from each task, you can choose to enable or disable future tasks automatically.

In addition to assigning tasks in a timely manner, the Phases features also helps leadership and management identify the current work state of the case/incident.