Incident Management: Investigate an Incident

Document created by RSA Information Design and Development Employee on Jul 20, 2016
Version 1Show Document
  • View in full screen mode

Once you create an incident manually or by using an automated process, the next step is to further investigate the incident, create a remediation task, add journal entries to include specifics and additional information for the incident, track the remediation tasks to closure, push the tasks as help desk tickets to resolve them, and finally decommission the incident.

The various stages of investigating an incident and the actions performed by an administrator are outlined in the table below.

  1. Access and view incident details. 
Refer to View Incident Details.
  1. Add a journal entry.
Refer to Add a Journal Entry.
  1. Create and track a remediation task. 
Refer to Create a Remediation Task.
  1. Push a remediation task as a Help Desk ticket
Refer to Send a Remediation Task as a Helpdesk Ticket.
  1. Close an incident.
Refer to Close an Incident.




You are here: Incident Management Process Flow > Incident Management: Investigate an Incident