View an Incident Response incident

View all incidents in the system.

Before you begin

Role required: Responder, Manager, Administrator, or Stakeholder

Procedure

  1. Log in to Incident Response.
  2. On the left navigation pane, click Incidents.
    Note: Initially, the incidents page is empty, until you ingest incidents from a third-party integration. See Integrations in Incident Response for more information on setup and ingestion.
  3. View your incidents list.
    Incident list view

    Search incidents using the Search text box.

    Arrange the incident list view by:
    • Priority (asc)
    • Priority (desc)
    • Elapsed Time (asc) - Default
    • Elapsed Time (desc)
    • Number (asc)
    • Number (desc)
    • Recent Open (default)
    You can filter the listings using the Filters menu in the header.
    Note: Filters for the same fields evaluate as AND, filters for different fields evaluate as OR. For example, if you filter for Priority and State is Open, the filter evaluates as P1-Critical OR P2-High OR P3-Moderate AND State Open .

    If you click Incidents in the left navigation, it defaults to all Open incidents. If you use the back arrow button in your browser, the filter choices are retained.

  4. Optional: Create an incident.
  5. Optional: Click the information icon information icon to the left of an incident for a preview.

    The fly-out screen contains the incident header including tags, Details, and Activity areas of the incident. See Incident workspace for more information on those fields.

    Incident flyout screen
    More actions, More actions icon lets you:
    • Move the state of the incident.
    • Re-assign the incident.
    • Assign a team to the incident.
    • Open the full incident form.

    You can edit the Service or Priority fields in the flyout screen and Save.

  6. Click an incident or use Show full details from the flyout screen for the incident.

    The incident form contains not only the information related to the incident but options to search for further information and take actions. See the following example of an open incident.Incident form example

    From the header of every incident, the More actions More actions icon menu lets you Assign or Re-assign, or Re-assign team.

    Once the incident is assigned to you and you can:
    • Advance the state from Work in Progress to Resolve to Close.

      See Incident Response incident states for more information on each of the actions listed.

    • Add or edit a Service.
    • Edit Priority.
    • Review the Related alerts.

      See Incident workspace for more information on these fields.

    Note: Once you edit a field, the Save button becomes active so you can save the changes.
  7. View the Compose panel to add comments or work notes.
    Use the stack icon stack icon to reformat the panel to a stacked view.Compose panel
  8. View the Incident timeline panel activity stream.

    The timeline shows system activity since the incident was created and all work notes.

    You can filter, sort, or expand and collapse posts using the icons in the header.

    Incident timeline
  9. Add or view attachments using the attachment icon icon in the upper right of the Attachments panel. This icon opens or hides the column.
  10. View the Collaboration panel using the collaboration icon Collaboration icon. This icon opens or hides the column.
    • Start or join an available Zoom meeting.
    • Start or join an available Slack channel.
    • Add responders or stakeholders to the incident.

    See Incident workspace for more information on each of the actions listed.

  11. Use the incident screen icons icons at the bottom of the screen to display: the incident form in full screen, the incident form and activity area, or the activity area in full screen.