Fortinet black logo

Administration Guide

Raising an incident

Raising an incident

You can raise an incident only from alerts generated for one endpoint.

Incidents can be raised in the following ways:

  • In FortiSoC/Incidents & Events > Incidents, click Create New in the toolbar. This opens the Create New Incident pane.
  • In FortiSoC/Incidents & Events > Event Monitor > All Events, right-click an event and select Create New Incident. This opens the Raise Incident pane with the applicable fields filled in, such as the Affected Endpoint.

The following is a description of the options available in the Create New Incident and Raise Incident pane.

Incident Category

Select a category from the dropdown list.

Severity

Select a severity level from the dropdown list.

Status

Select a status from the dropdown list.

Affected Endpoint

In the Raise Incident pane, the affected endpoint is filled in and cannot be changed.

In the Create New Incident pane, select the affected endpoint from the dropdown list.

Description

If you wish, enter a description.

Assigned To

The admin account to which the incident is assigned.

Raising an incident

You can raise an incident only from alerts generated for one endpoint.

Incidents can be raised in the following ways:

  • In FortiSoC/Incidents & Events > Incidents, click Create New in the toolbar. This opens the Create New Incident pane.
  • In FortiSoC/Incidents & Events > Event Monitor > All Events, right-click an event and select Create New Incident. This opens the Raise Incident pane with the applicable fields filled in, such as the Affected Endpoint.

The following is a description of the options available in the Create New Incident and Raise Incident pane.

Incident Category

Select a category from the dropdown list.

Severity

Select a severity level from the dropdown list.

Status

Select a status from the dropdown list.

Affected Endpoint

In the Raise Incident pane, the affected endpoint is filled in and cannot be changed.

In the Create New Incident pane, select the affected endpoint from the dropdown list.

Description

If you wish, enter a description.

Assigned To

The admin account to which the incident is assigned.