Create Incident Workflow
You can create multiple incident workflows to respond to various types of incidents.
Note
You can create a maximum of 50 active incident workflows. However, there is no limit to the number of inactive and draft incident workflows.
Before you Start
Ensure that you have Create/Update permission for Form Management.
Steps
To create an incident workflow, follow these steps:
Go to Admin > Form Management > Incidents.
Click Create Incident Workflow and enter the following details:
Incident Workflow Name: Enter the name of the Incident Workflow. For example, Priority Threat Response Framework.
(Optional) Description: Enter a description for the Incident Workflow. The description is added as a tooltip for the Incident Workflow in the list of Incident Workflows.
Click Save & Proceed. You can view the Incident Details phase of the incident. Add fields as required.
To update the name of the Incident Details tab, click Edit and enter a name.
Note
The Incident Details tab is common across all incident workflows. The updated name of the tab will be displayed in all incident workflows.
To add phases to the incident workflow, follow these steps:
Note
You can add a maximum of 10 phases to an incident workflow.
In Phase, select a phase to add.
If the desired phase is unavailable, click New to add a new phase to the incident workflow. For more information, see Create Phase.
To configure the fields of a phase, drag fields from the Field Library on the right and drop them into the phase. If the desired field is unavailable, click New Field to add a new field to the field library. For more information, see the Create Field section in Manage Field Library. You can do the following to organize the fields of a phase:
Drag fields to re-arrange the fields in a phase.
Maximize or minimize fields for better space management and viewing experience in a phase.
(Optional) To add custom tabs to the Incident Workflow, on the Custom Tabs section, click +New and a name for the tab.
To configure the incident workflow, follow these steps:
Click Configuration.
Update the following details in Incident Workflow configurations:
Field
Description
Description
Enter a description of the Incident Workflow.
Phase Flow Type
Select a flow type:
Linear: The flow of phases is sequential and users cannot move between random phases.
Non-linear: The flow of phases is non-sequential and users can move between random phases.
Restrict phase transition if all mandatory fields are not filled
Select this checkbox to restrict moving to the next phase in incidents with linear workflows if all the mandatory fields are not filled.
This option is available only when the selected phase flow type is Linear.
Incidents can be closed after the phase
Select a phase during which the incident can be closed.
This field is available if the selected Phase flow type is Linear.
Click Save.
(Optional) To map action templates with various phases of the incident workflow, go to a phase and in the upper-right corner, click Mapped Actions. Select action templates and click Save. To create a new action template, click New Action Template. For more information, see Manage Action Templates for Incidents.
On the Incident Workflow configuration page:
To save the incident workflow as a draft, click Save draft.
To publish the incident workflow, click Publish.
After an Incident Workflow is published, you can add, update, or delete the fields and update the phases of the Incident Workflow. However, you cannot add new phases or delete any phase from the incident workflow.
The Preparation tab is common to all Incident Workflows and includes the fields that are necessary to provide the initial information when creating an incident.
Note
Only single-select fields of the Preparation tab can be configured as parent parameters.
Create Phase
When creating or updating an incident workflow, if the required phase is not available in the existing list of phases, then you can create a phase and add it to the incident workflow.
To create a phase, do the following:
Go to Admin Panel > Form Management > Incidents.
Select an incident workflow and click Edit on the right.
On the left pane, under the Phases section, click the New button. A new empty text box appears under the Phases section.
In the text box, enter the name of the new phase and click the save icon. The new phase appears under the Phases section.
Select the new phase.
From the Field Library on the right pane, search for the required field and drag the field to the space of the selected phase. If the required field is not available in the Field Library, then you can create a new field.
The phase is automatically saved when another phase is selected or when the incident workflow is saved.
For more information on some frequently asked questions about phases, see Incident Workflows FAQs.
Map Actions with Incident Workflow Phase
You can map multiple action templates with various phases of an incident workflow and automatically create the actions when an incident is created. When an incident is created, Respond automatically creates actions using the mapped action templates for each phase of the incident response.
To map actions with an incident workflow phase, do the following:
Go to Admin Panel > Form Management > Incidents.
Select an incident workflow and click Edit.
Select a phase.
Click Mapped Actions.
On Select Action Templates, select the action templates to map with the incident workflow phase.
Note
Respond displays the action templates that are available in the Actions Library.
To create an action template, click +New Action Template. For more information, see Manage Action Templates for Incidents.
Click Save.