Incident Response

Incident Response allows Fortinet Inc. customers with an active FortiGuard Incident Response service contract to request different service activities in exchange for Service Points. Incident Response provides support for planning your security posture, identifying gaps in your security processes, and develop a playbook in the event of a critical attack.

More information is available in the FortiGuard Incident Response Service description available in the Customer Service portal.

The Incident Response view displays the support tickets for your account. Use this view to monitor the status of your support requests and the Service Points applied to each request. You can create a new service ticket or view the ticket and comment on it in FortiCloud.

Users must have access to the root folder in their permission scope and have the correct entitlement registered to view the Incident Response page. For information, see Permission scope with Organizations in the Identity & Access Management guide.

Eligible contracts

Incident Response Requests (IR Requests) are available to customers with the following contracts:

• FortiGuard Incident Readiness Subscription Service

Service requests

Incident Response Requests provide support for planning your security posture, identifying gaps in your security processes, and develop a playbook in the event of a critical attack. Services include Incident Response Support, Incident Response Playbook Development, and more.

For information on service points, see Advanced Services.

Point Usage

The Point Usage tab shows the Service Requests for your account as well the ticket type, status, and points consumed by each request.

Point Usage	Description
Ticket ID	The FortiCare Ticket number associated with the Service Request. Click the Ticket ID to view the request details in FortiCloud and to comment on the ticket.
Type	The type of service requested. See Incident Response types.
Subject	The Subject text that was entered at the time the ticket was created. See Creating an Incident Response ticket.
Status	Pending: This is the default status after a service request has been submitted. Approved : Indicates the scope of service to be delivered and the total number of service points has been agreed upon between you and Fortinet Inc.. Canceled: Indicates the service cannot be delivered. No points are applied. Completed: Indicates the agreed upon service has been delivered and you agree to close the Service Request.
Request Date	The date the service request was created.
Close Date	The date the service request was closed.
Points	The number of points used for this activity.

Registered points

The Registered Points tab shows the contracts registered to your account and the points balance for each contract. The entitlement period of the points corresponds to the contract period. This means any unused points will be forfeited on the contract expiry date. If there are multiple active contracts, the points are consumed based on a first-in-first-out rule to ensure the points that are expiring are used first.

Points	Description
SN#	The account level product serial number.
Contract#	The contract number.
License#	The contract license number.
SKU	The reference number for the service type.
Activation Date	The contract registration date.
Expiration Date	The contract end date.
Points Used	The number of service points used by this contract.
Balance	The number of service points remaining for this contract. This number is updated each time a Service Request is moved to Completed.

To export the Point Usage and Registered Points:

1. Go to Incident Response.

2. Click Export As and select either Excel File or CSV File.