Skip to main content

Cyware Fusion and Threat Response

Manage Incident Workflow

You can perform the following activities to manage incident workflows:

  • Update an incident workflow to:

    • Add, remove, or update phases in a draft incident workflow.

      Note

      You cannot add or remove phases in a published incident workflow.

    • Add, remove, or update fields. To remove a field from a phase and delete it from the field library, select Delete this field from the field library and click Remove & Delete.

      Note

      If you delete a field from the field library, the incident workflow is automatically updated with all the unsaved changes.

  • Delete an incident workflow if the following conditions are met:

    • It is not being used by an incident.

    • It is not the default incident workflow.

    • It is not mapped to a workflow mapping.

  • Clone an incident workflow to create a copy and reuse within the same tenant instance.

  • Export an incident workflow in JSON format. You can reuse the incident workflow within the same tenant or other tenants by importing.

    Note

    You cannot export the fields of the Preparation phase and the associated conditional logic of the fields.

  • Activate or deactivate an incident workflow.

  • Mark a published and active incident workflow as the default incident workflow. By default, the NIST incident workflow is the default incident workflow. The default incident workflow is automatically assigned to the incidents for which a workflow mapping is not created for the parameter values that are added in the incidents.

Import Incident Workflow

You can import incident workflows in JSON format to reuse the workflows across tenant instances.

Note

Since the Preparation phase is common across incident workflows, the fields of the Preparation phase are not imported. Also, the conditional logic of the fields is not imported.

To import an incident workflow, do the following:

  1. Go to Menu > Form Management > Incident.

  2. Click Import Workflow in the top-right corner.

  3. Select the JSON file to be imported and click Open. If a field already exists in the Field Library with the same name or readable key, the field details will not be imported with the incident workflow.

  4. Select the fields that you want to keep in the imported incident workflow with the existing field data and click Save & Proceed.

    Note

    Unselected fields are removed from the imported incident workflow and you must manually add them from the field library.

The incident workflows will be imported in the background. After a successful import, the incident workflow appears under the draft workflows.