Incident workspace

The incident workspace contains various panels containing incident details and possible actions.

The top header contains description information, tags, impact information, elapsed time, promotion identity, and priority. Standard buttons move the status or save the record.
Note: Tags are imported from third-party integrations and attached to incidents. However, you can also create tags to categorize data and drive system logic using the tag icon Tag icon. For more information on creating and viewing tags, see Manually create Incident Response tags.

Details

This section contains three content panels: Details, Compose, Incident timeline
Note: When an editable field is updated, notifications are sent based on user notification preferences.
Table 1. DetailsContains incident details and related alerts
Field Description
Service Services in your infrastructure associated with the incident. You can edit this field from a list menu.
Note: When you set a service, and that service has an assigned team, the assigned team of that service is automatically assigned to the incident.
Priority Imported priority on the incident. Values P1–P5.
Assigned team Team the assignee belongs to. You can edit this field.
State Incident state. See Incident Response incident states for more information.
Assigned to Individual the incident has been assigned to. You can edit this field.
Source Source of the incident.

Related Alerts tab

This tab contains any alerts associated with this incident.

Note: All field values are imported from the related alert record. Team, Service, and Assigned to fields are links to the Team, Service, and User pages.
Field Description
Number & Description Related alert identifier and short description.
Service Service associated with the related alert.
Priority Priority group for the related alert.
State Status of the related alert.
Ack States whether the related alert has been acknowledged or not.
Team Team assigned to the related alert.
Assigned to Responder the related alert is assigned to.
Source Source of the related alert, if known.
Compose
Work notes: Add comments and post Work notes to the Incident timeline activity stream. Visible to responders and above. Notifications are sent for all updates based on user notification preferences.
Note: Use the stack icon stack icon Stack icon to reformat the panel to a stacked view.
Incident timeline
Stream that contains all the system activity, comments, and work notes. You can filter, sort, expand or collapse all posts using the header icons.

Activity header icons
Attachments

The Attachments panel is hidden until you click the attachment icon attachment icon.

On the Attachments panel, you can initially Browse your local hard drive for files.

Once you have added attachments, you can:
  • Search for an attachment based on its name or extension
    Note: You must have two or more attachments to search.

    Search attachments
  • Upload a new attachment using the (add icon) icon
  • Download an existing attachment using the More actions icon (More actions icon) to the right of the attachment.
  • Remove an existing attachment using the More actions icon to the right of the attachment.
  • Rename an existing attachment using the More actions icon to the right of the attachment.

    Attachments menu
Collaboration

Displays available Slack channel or Zoom meeting to start or join.Collaboration panel

To start or join a Zoom meeting:
Note: The Zoom integration and recognized IDs must be active in your instance. If you see a Setup Zoom meeting button on your alert, and you do not have Zoom administrator account credentials, contact your administrator. See Zoom integration with Incident Response for more information.
  1. Click Start Zoom.
    • A meeting pop-up appears.
    • Add participants.
    • Click Create Meeting.
    • The meeting is created, invitations are sent, and you join the meeting.
  2. Click Join Meeting
    • Sign in to your Zoom account.
    • You join the Zoom meeting.
Start or join a Slack channel:
Note: The Slack integration and recognized IDs must be active in your instance. If you see a Setup Slack channel button on your alert, and you and do not have Slack admin account credentials, contact your admin. See Slack integration with Incident Response for more information.
  1. Click Start Slack.
    • Add participants in the Create a Slack channel pop-up.
    • Click Create. You are redirected to the Slack application.
    • Back in the Collaboration column, the Join Slack button is activated.
  2. Click Join Channel in the Slack application window.
    • Sign into you Slack account.

      You are taken to the Slack channel.

Note: When a Zoom meeting or Slack channel is created, details for the meeting or channel are posted as work notes to the timeline.
Responders and Stakeholders

Add responders or stakeholders from the list menu and click the Add icon. Responders are notified based on their notification preferences. Stakeholders are notified by email.