Reviewing incidents

To help you track when you start investigating an incident, you can set its status to "In review".

The Incidents module lets you mark incidents as "In review" individually or in bulk, as follows.

How to review a single incident

1. In the FortiDLP Console, on the left-hand sidebar, click .
2. Filter for the relevant incident by following the steps in Viewing incidents.
3. Do one of the following:
   • To mark an incident as "In review" on the Incidents overview page:
     1. At the end of the incident's table row, click> Mark as In review.
        
   • To mark an incident as "In review" on the Incident details page:
     1. Select the incident's table row.
     2. On the top-right corner of the page, click Change status > Mark incident as In review.
        
        
4. In the Review incident? dialog box, do the following:
   1. Optionally, in the Reason field, type a reason for reviewing the incident.
   2. Click Confirm.

Once you finish an investigation, you can resolve the incident. For more information, see Resolving incidents.

How to review multiple incidents

1. In the FortiDLP Console, on the left-hand sidebar, click .
2. Filter for the relevant incidents by following the steps in Viewing incidents.
3. On the top-right corner of the page, click Change status > Mark [n] incidents as In review.
   
   
4. In the Review [n] incidents? dialog box, do the following:
   1. Optionally, in the Reason field, type a reason for reviewing the incidents.
   2. Click Confirm.

Once you finish an investigation, you can resolve the incident. For more information, see Resolving incidents.