After investigating incidents, in the Tasks List view (Respond > Tasks), you can create and track incident tasks. For example, you can create remediation tasks when you require actions on incidents from teams outside of your security operations. You can reference external ticket numbers within the tasks and then track those tasks to completion. You can also modify and delete tasks as required, depending on your user permissions.
What do you want to do?
Role | I want to ... | Show me how |
---|---|---|
Incident Responders, Analysts | View tasks | View All Incident Tasks and View the Tasks Associated with an Incident |
Incident Responders, Analysts | Filter tasks. | |
Incident Responders, Analysts | Create a task. | Create a Task |
Incident Responders, Analysts | Find and modify tasks. | Find a Task and Modify a Task |
Incident Responders, Analysts | Close a task (Change the Status to Remediated, Risk Accepted, or Not Applicable). | Modify a Task |
Incident Responders, Analysts, SOC Managers | Delete a task. | Delete a Task |
Related Topics
Quick Look
To access the Tasks List view, go to Respond > Tasks. The Tasks List view displays a list of all incident tasks.
The Tasks List view consists of a Filters panel, a Tasks List, and a Task Overview panel. The following figure shows the Tasks List and the Overview panel.
Tasks List
The Tasks List shows all of the incident tasks. You can filter this list to show only tasks of interest.
At the bottom of the list, you can see the number of tasks on the current page and the total number of tasks. For example: Showing 23 out of 23 items
Task Filters Panel
The following figure shows the filters available in the Filters panel.
The Filters panel, on the left of the Tasks List view, has options that you can use to filter the incident tasks.
The Tasks List shows a list of tasks that meet your selection criteria. You can see the number of items in your filtered list at the bottom of the tasks list. For example: Showing 18 out of 18 items
Task Overview Panel
To access the Task Overview panel:
-
Go to Respond > Tasks.
- In the Task list, click the task that you want to view.
The Task Overview panel appears to the right of the Tasks list.
The following table lists the fields displayed in the Task Overview panel.
Field | Description |
---|---|
<Task ID> | Displays the automatically assigned task ID. |
<Task Name> | Displays the task name. This is an editable field. To change the task name, you can click the current task name to open a text editor. For example, you can change a task name from "Reimage a Laptop" to "Reimage a Server". |
Incident ID | Displays the Incident ID for which the task was created. Click the ID to display the details of the Incident. |
Created | Displays details about the date and time when the task was created. |
Last Updated | Displays the date and time when the task was last updated. |
Priority | Displays the priority of the task: Low, Medium, High, or Critical. To change the priority, you can click the priority button and select a priority for the task from the drop-down list. |
Status | Displays the status of the task: New, Assigned, In Progress, Remediated, Risk Accepted, and Not Applicable. To change the status, you can click the status button and select a status for the task from the drop-down list. |
Assignee | Displays the user assigned to the task. To change the user assigned to the task, you can click (Unassigned) or the name of the previous assignee to open a text editor. |
Description | Shows task details. To modify the description, you can click the text underneath the description to open a text editor. |
Toolbar Actions
This table lists the toolbar actions available in the Tasks List view.