Incident Management: Investigate an Incident

Once you create an incident manually or by using an automated process, the next step is to further investigate the incident, create a remediation task, add journal entries to include specifics and additional information for the incident, track the remediation tasks to closure, push the tasks as help desk tickets to resolve them, and finally decommission the incident.

The various stages of investigating an incident and the actions performed by an administrator are outlined in the table below.

Topics

• Add a Journal Entry
• Create a Remediation Task
• Send a Remediation Task as a Helpdesk Ticket
• Send a Remediation Task to RSA Archer
• Close an Incident