Incident Management: Investigate an Incident

Document created by RSA Information Design and Development Employee on Oct 24, 2017Last modified by RSA Information Design and Development Employee on Jan 29, 2018
Version 2Show Document
  • View in full screen mode

Once you create an incident manually or by using an automated process, the next step is to further investigate the incident, create a remediation task, add journal entries to include specifics and additional information for the incident, track the remediation tasks to closure, push the tasks as help desk tickets to resolve them, and finally decommission the incident.

The various stages of investigating an incident and the actions performed by an administrator are outlined in the table below.

  1. Access and view incident details. 
Refer to View Incident Details.
  1. Add a journal entry.
Refer to Add a Journal Entry.
  1. Create and track a remediation task. 
Refer to Create a Remediation Task.
  1. Push a remediation task as a Help Desk ticket
Refer to Send a Remediation Task as a Helpdesk Ticket.
  1. Close an incident.
Refer to Close an Incident.




Previous Topic:Edit Incidents
You are here
Table of Contents > Incident Management Process Flow > Investigate an Incident