Creating a new incident
Incidents are created automatically based on data ingested by the SOAR Platform. You can also create incidents manually, if you have permissions.
To create a new incident, click Create next to Incidents in the menu bar. It starts a wizard that guides you through entering the incident details, reviewing the suggested actions based on those specifics, and forming an incident response team. The following figure shows an example of the first page. Your wizard might show different steps.
Some answers might cause extra steps to appear in the wizard. For example, indicating that Personal information or Personal Data was involved causes the system to add steps. These steps help you to document specific information about the incident to determine any potential notification obligations. Your answers assist the SOAR Platform to properly assess the incident and generate an appropriate playbook.
If your administrator created workspaces, you might be prompted to select the appropriate workspace for this incident.