Skip to main content

Cyware Fusion and Threat Response

  • Cyware Fusion and Threat Response
  • How To Articles
  • Create an Incident Workflow

Create an Incident Workflow

The Incident Workflow defines the life-cycle that security teams should follow for threat response. Incident Workflow provides the needed flexibility for CFTR admins to adopt multiple incident response flows for various types of incidents. Using Incident Workflow CFTR admins can define the phases of the incident response flows.

Before you Start

To create an incident workflow, you must have CREATE/UPDATE permission for the Form Management module.

Steps

  1. Go to Admin Panel > Form Management > Incidents.

  2. Click Create Incident Workflow.

  3. On the Create Incident Workflow page:

    1. In the Incident Workflow Name field, enter the name of the Incident Workflow.

    2. (Optional) Enter a description of the Incident Workflow. The description appears as a tooltip for the Incident Workflow in the list of Incident Workflows.

    3. Click Save & Proceed.

  4. On the left pane, to add phases to the Incident Workflow, do one of the following:

    • To create a phase, click +New.

    • To reuse an existing phase:

      • Search and select a phase.

      • Select an Incident Workflow of the phase that you want to use and click OK.

  5. (Optional) To add custom tabs to the Incident Workflow, on the Custom Tabs section, click +New.

  6. Configure the Incident Workflow:

    1. Click Configuration.

    2. Update the Incident Workflow configuration:

      Field

      Description

      Description

      Enter a description of the Incident Workflow.

      Phase flow type

      Select a flow type:

      • Linear: The flow of phases is sequential and users cannot move between random phases.

      • Non-linear: The flow of phases is non-sequential and users can move between random phases.

      Incidents can be closed after this Phase

      Select a phase. The incident can be closed when the incident is in the selected phase.

      This field is available if the selected Phase flow type is Linear.

  7. Click Save.

  8. On the Incident Workflow configuration page:

    1. To save the Incident Workflow as a draft, click the Save draft button.

    2. To publish the Incident Workflow, click the Publish button.

After an Incident Workflow is published, you can add, update, or delete the fields and update the phases of the Incident Workflow. But you cannot add new phases or delete any phase from the Incident Workflow.