Working with incidents

This section contains general information about incidents, their properties, typical life cycle, and connection with alerts. This section also gives instructions on how to create incidents, analyze the incident table, change incident properties according to the current state in the life cycle, and merge incidents.

The Incidents section is displayed in the main menu if the following conditions are met:

• You have a license key for Kaspersky Next XDR Expert.
• You are connected to the root Administration Server in OSMP Console.
• You have one of the following XDR roles: Main administrator, Tenant administrator, Junior analyst, Tier 1 analyst, Tier 2 analyst, SOC manager, Interaction with NCIRCC, Approver, Observer, Interaction with child incidents.

In this section About incidents Incident data model Creating incidents Creating child incidents Viewing the incident table Viewing incident details Assigning incidents to analysts Changing an incident status Changing an incident priority Changing an incident type Merging incidents Investigation graph Segmentation rules Copying segmentation rules to another tenant Managing incident types Managing incident workflows

Page top