Manage Incidents
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- One of the following licenses:
|
An incident is an indication of a fault in the system or a noncompliance with asset
rules, whether predefined policies or user-defined policies, and security control
policies. Incidents are triggered when the system detects issues, such as reaching
system-defined or customer-defined thresholds, or when a fault occurs.
The Unified Incident Framework consolidates all incidents from various security products
into a single interface, offering comprehensive visibility into your entire security
infrastructure. This framework means that product-specific alerts and incidents are now
located under the "Incidents" section, while previous dashboards remain in read-only
mode for reference.
Configure default and custom incident settings to control how Strata Cloud Manager
evaluates your infrastructure, detects deviations from best practices, and raises or
suppresses incidents. Learn how to customize incident visibility, set priority levels,
and attach notification profiles.
Default Settings—View and modify
preconfigured incident settings that serve as the baseline configuration for all
tenants. You can adjust actions, priority levels, notification profiles, and
check rules for each incident code.
Custom Settings—Create tenant-specific
settings that override defaults for granular control over incident management,
including scheduled suppression, object-specific handling, and targeted
notifications.
Create a Custom Incident
Setting—Define a custom incident setting by selecting the product,
severity, incident category, object type, and action (raise or suppress), then
attach a notification profile.
Custom Posture Check Management—Create
and manage custom posture checks that evaluate configuration compliance against
your defined security policies using the Logic Builder to define conditions,
exceptions, and enforcement actions.
Incident Setting Resolution—Understand
the precedence and longest-match logic that Strata Cloud Manager uses to
determine which setting applies when multiple settings match a specific
incident.
Incident Categories and
Subcategories—Review the full list of incident categories (Device,
Network & Traffic, Security Services, Network Services, Digital Experience,
Configuration, and Endpoint) and their subcategories.
WildFire Incidents—Configure WildFire
incident codes to surface findings from WildFire analysis as incidents. WildFire
uses a suppress-by-default model, so you must create custom settings to receive
alerts for specific resources.
Configure notification profiles to receive alerts through email or webhooks when Strata
Cloud Manager raises, updates, or clears incidents. You can test email delivery and
webhook connectivity before deploying profiles in production.
Associated Events Email
Notifications—Control whether notification profiles send email alerts for
associated events (new alerts correlated with an existing incident). This
setting is disabled by default to reduce notification volume.
Webhook Data Schema for
Incidents—Review the webhook payload data model, including field
descriptions and an example JSON payload that Strata Cloud Manager sends to your
configured endpoint.
Connect Strata Cloud Manager to ServiceNow to automatically create and update ServiceNow
tickets when incidents are raised or cleared. You can configure bidirectional or
unidirectional integration with OAuth authentication.
