Raising an incident
You can raise an incident only from alerts generated for one endpoint.
Incidents can be raised in the following ways:
- In Incidents & Events/FortiSoC > Incidents > All Incidents, click Create New in the toolbar. This opens the Create New Incident pane.
- In Incidents & Events/FortiSoC > All Events, right-click an event and select Raise Incident. This opens the Raise Incident pane with the applicable fields filled in, such as the Affected Endpoint.
The following is a description of the options available in the Create New Incident and Raise Incident pane.
|
Incident Reporter |
The admin account raising the incident. This field cannot be changed. |
|
Incident Category |
Select a category from the dropdown list. |
|
Severity |
Select a severity level from the dropdown list. |
|
Status |
Select a status from the dropdown list. |
|
Affected Endpoint |
In the Raise Incident pane, the affected endpoint is filled in and cannot be changed. In the Create New Incident pane, select the affected endpoint from the dropdown list. |
|
Description |
If you wish, enter a description. |