Skip to main content

Cyware Fusion and Threat Response

Update Action

To update an action, go to Menu > Actions and open an action. To view the basic details of the action, on the right side, click Show Overview. Under Overview, you can view the following details of the action:

  • Action Data: Displays the action ID, the assigned user and user group, time to detect, assignment and resolution SLAs, created and last updated details, and the labels that are added to categorize the action.

  • Connect the Dots: Displays the number of various modules linked to the action under Connect the Dots.

  • Notes: Displays a list of notes that are added in the action.

To view the requirements of an action that are added while creating the action, select Summary on the left. Analyze the action details and perform the tasks as per the requirements of the action. You can also use the Orchestrate Playbooks to automate manual tasks. For more information, see Run Playbooks.

After performing the tasks, add the task details in the action. To add the details, do the following:

Note

Only the assigned user can update an action.

  1. Go to Menu > Actions and open an action.

  2. Select Summary on the left.

  3. Hover over a field and click Edit.

  4. Add the details and click Save.

To view the update history of a field, hover over a field and click History. You can view the log entries of all the updates of the field.

Update Action Status

On the top-right corner of an action, the drop-down list shows the status of an action. Following are the various states of an action:

  • Draft: Indicates that the action includes incomplete information and cannot be assigned to an analyst.

  • Open: Indicates that the action must be addressed.

  • In Progress: Indicates that the action is being addressed.

  • Resolved: Indicates that the action has been resolved. The Resolution SLA timer stops when an action is marked as resolved.

    Note

    Resolved actions must be assigned to a reviewer to review and close the actions.

  • Closed: Indicates that the action has been reviewed and closed.

To update the action status, do the following:

  1. Go to Menu > Actions and open an action.

  2. Click the current status of the action on the top-right.

  3. Select a new status.

  4. (If the new status is Closed) Add a closure note.

  5. Click Yes, Proceed on the confirmation message.