Respond: Tasks List View

Document created by RSA Information Design and Development on Sep 14, 2017Last modified by RSA Information Design and Development on Oct 15, 2017
Version 6Show Document
  • View in full screen mode
  

After investigating incidents, in the Tasks List view (RESPOND > Tasks), you can create and track incident tasks. For example, you can create remediation tasks when you require actions on incidents from teams outside of your security operations. You can reference external ticket numbers within the tasks and then track those tasks to completion. You can also modify and delete tasks as required, depending on your user permissions.

What do you want to do?

                                           
RoleI want to ...Show me how

Incident Responders, Analysts

View tasks

View All Incident Tasks and View the Tasks associated with an Incident

Incident Responders, AnalystsFilter tasks.

Filter the Tasks List

Incident Responders, AnalystsCreate a task.Create a Task
Incident Responders, AnalystsFind and modify tasks.Find a Task and Modify a Task
Incident Responders, AnalystsClose a task (Change the Status to Remediated, Risk Accepted, or Not Applicable).Modify a Task
Incident Responders, Analysts, SOC ManagersDelete a task.Delete a Task

Related Topics

Tasks List

To access the Tasks List view, go to RESPOND > Tasks. The Tasks List view displays a list of all incident tasks.

Tasks List View

The Tasks List view consists of a Filters panel, a Tasks List, and a Task Overview panel. The following figure shows the Tasks List and the Overview panel.

Tasks view showing the Task Overview panel

Tasks List

The Tasks List shows all of the incident tasks. You can filter this list to show only tasks of interest.

                                                   
Column

Description

Checkbox icon Enables you to select one or more tasks to modify or delete. Users with the appropriate permissions can make bulk updates and delete tasks, such as SOC Managers. For example, an SOC Manager may want to assign multiple tasks to a user at the same time.
CREATEDDisplays the date when the task was created.
PRIORITYDisplays the priority assigned to the task. The priority can be any of the following: Critical, High, Medium, or Low. The Priority is also color coded, where red indicates Critical, orange represents High risk, yellow indicates Medium risk, and green represents Low risk as shown in the following figure:
Priorities showing color coding
IDDisplays the task ID.
NAMEDisplays the task name.
ASSIGNEEDisplays the name of the user assigned to the task.
STATUSDisplays the status of the task: New, Assigned, In Progress, Remediated, Risk Accepted, and Not Applicable.
LAST UPDATEDDisplays the date and time when the task was last updated.
CREATED BYDisplays the user who created the task.
INCIDENT IDDisplays the incident ID for which the task was created. Click the ID to display the details of the incident.

At the bottom of the list, you can see the number of tasks on the current page and the total number of tasks. For example: Showing 23 out of 23 items

Filters Panel

The following figure shows the filters available in the Filters panel.

Tasks List Filters panel

The Filters panel, on the left of the Tasks List view, has options that you can use to filter the incident tasks.

                                               
OptionDescription
TIME RANGE You can select a specific time period from the Time Range drop-down list. The time range is based on the creation date of the tasks. For example, if you select Last Hour, you will see tasks that were created within the last 60 minutes.
CUSTOM DATE RANGE You can specify a specific date range instead of selecting a Time Range option. To do this, click the white circle in front of Custom Date Range to view the Start Date and End Date fields. Select the dates and times from the calendar.
Custom Date Range option in the filter
TASK IDYou can type the Task ID for a task that you would like to locate, for example REM-123.
PRIORITYYou can select the priorities that you would like to view. If you make one or more selections, the Tasks list shows only those tasks with the selected priorities.
For example: If you select Critical, the Tasks list shows only the tasks with a priority set to Critical.
STATUSYou can select the statuses that you would like to view. If you make one or more selections, the Tasks list shows only those tasks with the selected statuses.
For example: If you select Assigned, the Tasks panel shows only the tasks that are assigned to users.
CREATED BYYou can select the user who created the tasks that you would like to view. For example, if you only want to view the tasks created by Edwardo, select Edwardo from the CREATED BY drop-down list. If you want to view tasks regardless of the person who created the task, do not make a selection under CREATED BY.
Reset FiltersRemoves your filter selections.

The Tasks List shows a list of tasks that meet your selection criteria. You can see the number of items in your filtered list at the bottom of the tasks list. For example: Showing 18 out of 18 items

Task Overview Panel

To access the Task Overview panel:

  1. Go to RESPOND > Tasks.

  2. In the Task list, click the task that you want to view.
    The Task Overview panel appears to the right of the Tasks list.
    Task Overview panel

The following table lists the fields displayed in the Task Overview panel.

                                               

Field

Description

<Task ID> Displays the automatically assigned task ID.
<Task Name> Displays the task name. This is an editable field. To change the task name, you can click the current task name to open a text editor. For example, you can change a task name from "Reimage a Laptop" to "Reimage a Server".
Incident IDDisplays the Incident ID for which the task was created. Click the ID to display the details of the Incident.
CreatedDisplays details about the date and time when the task was created.
Last UpdatedDisplays the date and time when the task was last updated.
PriorityDisplays the priority of the task: Low, Medium, High, or Critical. To change the priority, you can click the priority button and select a priority for the task from the drop-down list.
StatusDisplays the status of the task: New, Assigned, In Progress, Remediated, Risk Accepted, and Not Applicable. To change the status, you can click the status button and select a status for the task from the drop-down list.
AssigneeDisplays the user assigned to the task. To change the user assigned to the task, you can click (Unassigned) or the name of the previous assignee to open a text editor.
DescriptionShows task details. To modify the description, you can click the text underneath the description to open a text editor.

Toolbar Actions

This table lists the toolbar actions available in the Tasks List view.

                        
OptionDescription
Filter icon

Enables you to open the Filters panel so that you can specify the tasks that you would like to see in the Tasks List.

Close (X) icon

Closes the panel.

Delete buttonAllows you to delete the selected tasks.
Previous Topic:Alert Details View
You are here
Table of Contents > NetWitness Respond Reference Information > Tasks List View

Attachments

    Outcomes