Focus

SaaS Security Administrator's Guide

Modify Incident Status

Table of Contents

Modify Incident Status

Modify one incident at a time or use Bulk Incident to modify the status of multiple incidents without closing the incidents.

After you close incidents that aren’t a threat to your organization and assign other incidents, as part of manual remediation, the next step is to modify the incident status for the remaining incidents that are threats to reflect the remediation stage. When you assign incidents a status, you can manage remediation more efficiently.

If you want to review the changes made to an incident by an administrator, inspect the administration activity logs.

To modify incident status, go to Data SecurityIncidents.
Select the asset.
Click ActionsChange Status.
Select an open Status:
- Assigned—you assigned the incident to another administrator for remediation. Consider that you can assign such incidents as part of automatic remediation too.
- In-Progress—you are investigating the incident.
- Pending—you await the results of an action before you can assess and investigate the incident.

Email Asset Owners

Generate Reports on Data Security