You define all of the tasks that might need to be performed by end users, such as an analyst or case responder.

Tasks can be in the form of a set of instructions or advisories.

If using rules, a task can also take the form of an action that a responder selects. When the responder finishes the task, it can be marked and recorded as completed.

As you define the tasks, keep in mind your organization’s polices as to responding to a particular situation. Tasks must be specific and repeatable to the incident or situation at hand.