Create Crisis Alerts
CSAP helps analysts create crisis alerts when there is a critical security incident such as a data breach, malware infection, ransomware attack or other incidents. Crisis alerts enable real-time communication with members and help you gauge the impact of the incident.
For example, if there is a data breach or ransomware attack in your organization, create a crisis alert to immediately mitigate the impact of the breach. Analysts can also track responses to the crisis communication sent to members.
Note
Crisis notification alerts are sent immediately and cannot be scheduled. The alert scheduling options are disabled for crisis alerts.
You can create crisis alerts in two ways:
From Alerts: You can create a crisis alert when you select Crisis Notification as the category in the alert creation form. Use the steps in the following section to know more about creating crisis alerts from Alerts.
From Crisis Management: You can also create a crisis alert by navigating to Crisis Management in the Analyst Portal. When you create an alert this way, the category is automatically set to Crisis Notification. For more information, see Create Crisis Alerts from Crisis Management.
Before you Start
You must have View and Create permissions in the Alerts.
Configure recipient groups. To configure, see Recipient Group.
Steps
To create a crisis alert from Alerts, do the following:
In the Analyst Portal, click Home > Alerts.
Click Create and select New Alert.
In the Required section, enter the mandatory details (title, summary, TLP, category). Make sure to select Crisis Notification as the category.
Note
Crisis Notification is available as a system category in the Analyst Portal. For information about system categories, see View System Alert Categories.
In the Recipients section, select the recipients for the crisis alert. After selecting the recipients, you can configure preferences to send push notifications for the alert on mobile, email, SMS, and voice (phone) calls.
If you select SMS Alert while configuring push notifications, you have the option to send an additional SMS alert which is sent in addition to the default crisis SMS. In the default crisis SMS, the member receives the alert title and a link to confirm their acknowledgment of the crisis alert. In the additional SMS alert, you can enter a custom message which helps you give more insight into the crisis.
Fill in the other required details for the crisis alert. For more information about adding details to alerts, see Create Alerts.
Click Preview & Publish to send crisis notifications to the recipients. Crisis notifications are sent in the form of email notifications, Member Portal notifications, voice calls, or SMS alerts. Analysts cannot disable these notifications for crisis alerts. Based on your configuration, a crisis alert is received as an email notification, Member Portal notification, voice call, or SMS alert.
Create Crisis Alerts from Crisis Management
You can also create a crisis alert by navigating to Crisis Management in the Analyst Portal. For more information about crisis management, see Crisis Management.
Before you Start
You must have the View, Create, and Update crisis management permissions in Crisis Management.
Configure recipient groups. To configure, see Recipient Group.
Steps
To create a crisis alert from Crisis Management, do the following:
Sign in to the Analyst Portal.
From the side bar, click Crisis Management. You can create a crisis alert in one of the following ways:
Click Create From Templates to create an alert from an existing template. If you are creating a crisis alert from an existing template, then the title, description, category, and TLP are filled automatically. See Crisis Management Settings.
Click Create New to create a crisis alert. Verify that Crisis Notification is selected as the Category for this alert.
Fill in the other required details for the crisis alert. For more information about adding details to alerts, see Create Alerts.
Click Preview & Publish to send crisis notifications to the recipients. Crisis notifications are sent in the form of email notifications, Member Portal notifications, voice calls or SMS alerts. Analysts cannot disable these notifications for crisis alerts. Based on your configuration, a crisis alert is received as an email notification, Member Portal notification, voice call, or SMS alert.
View Crisis Alerts in the Analyst Portal
View the list of crisis alerts published from the Analyst Portal in Crisis Management.
Analysts can view details such as alert ID, title, alert creation information, and recipient response.
Click Not Responded for an alert to view users who have not responded to the crisis alert.
Click Responded for an alert to view users who have responded to the alerts. You can view the responders' email address, and response method (web, mobile, email), along with the date and time of response.
Analysts can search for alerts or filter the search results by date range and location.