Kaspersky Next XDR Expert

Changing an incident type

You can change the type of an incident in any status. If you change the type of an incident with a status other than Closed, the incident status automatically changes to New. For incidents with the Closed status, the status remains unchanged when you change the incident type.

After you change the incident type, the playbook does not trigger automatically. If necessary, you can manually launch the playbook.

To change the type of an incident:

1. In the main menu, go to Monitoring & reporting → Incidents.
2. In the incident table, click the ID of the required incident.

   The Incident details window is opened.

3. Click the Edit button.
4. In the window that opens, in the Type drop-down list, select a new incident type.
5. Click the Save button.

The type of the incident is changed.