Focus
Strata Cloud Manager

Incidents

Table of Contents

Incidents

Learn about the incidents framework that provides centralized solution for managing incidents across Palo Alto Networks network security products.
Where Can I Use This?What Do I Need?
Incidents provides a centralized solution for managing incidents across Palo Alto Networks products: Next-Generation Firewalls (NGFW) and Prisma Access. The incident framework aggregates incident data, offering a consolidated view for monitoring, troubleshooting, and resolving issues impacting network availability, security posture, and performance.
An incident is a current or emerging degradation in availability, security posture, or performance requiring your action. Incidents provides the following capabilities:
  • Display the total number of open incidents.
  • Provide breakdowns of incidents by product type, category, severity, and priority.
  • Track trends in incident creation and resolution.
  • Show operational status and assigned operators.
Each incident includes the following fields:
  • ID, title, severity, priority, and state
  • Product category and subcategory
  • Impacted objects
  • Remediation information
    Some of the incidents contain the root cause information along with remediation.
  • Timestamps and history
The incident framework aims to provide a comprehensive solution for incident management with features varying by license tier, focusing on providing IT admins with the tools to effectively monitor and respond to issues in their deployments.
Here’s the data shown under Summary:
  • RAISED PAST 24H: Displays the number of incidents raised in the last 24 hours and the preceding 24-hour period.
  • CLEARED PAST 24H: Displays the number of incidents cleared in the last 24 hours and the preceding 24-hour period.
  • SUPPRESSED PAST 24H: Displays the number of incidents suppressed in the last 24 hours and the preceding 24-hour period.
  • RECOMMENDED ACTIONS: Provides suggestions for optimizing incident management, including:
    • Setting up default notification profiles
    • Configuring incident parameters
    • Improving operational health
  • BY SEVERITY: Categorizes incidents by severity (Critical, High, Warning, and Informational) and displays the count for each.
    Click the counts within the widgets to apply a filter to display only the corresponding incidents. For example, click the count next to Critical to filter the view to show only critical incidents. Alternatively, you can use the filters on the page to focus on specific incidents.
  • BY PRODUCT: Categorizes incidents by product type.
  • BY PRIORITY: Categorizes incidents by priority with P1 being the most severe.
  • BY CATEGORY: Categorizes incidents by category. You can further drill down to the device sub category.
  • INCIDENT TREND: Displays a historical graph of incident trends over time. Hover over the graph to view the number of incidents raised, cleared, and newly raised at specific points in time. Use the drop-down to select the desired time range.
  • A tabular view of all incidents is available with the following functionalities:
    • Expand to view only the table.
    • Perform actions:
      • Acknowledge or Unacknowledge: Toggle the acknowledgment status of an incident.
      • Add Comment: Add comments to an incident.
      • Manually Clear: Manually resolve and clear an incident.
    • Click an incident to view its details.
    • Customize displayed columns and their order.

View Incident Details

From Incidents, select an incident to open a page with the following details about it.
  • Description: Comprehensive details of the incident, including:
    • Primary impacted objects
    • Related objects
    • Priority: Ability to set or modify the incident priority.
    • Raised time: The timestamp when the incident was created.
    • Last updated: The timestamp of the last modification to the incident.
    • More: Provides additional information such as Category, Sub-category, Raise Conditions, and Clear Conditions. Acknowledge or unacknowledge actions are also available here.
  • Evidence: A list of devices impacted by the incident.
  • Remediation: Recommendations and resources for resolving the issue.
  • Activity Log: A chronological record of notifications sent, comments, parent, child, and related incidents, and recent occurrences.
For posture-related incidents, the following additional information is provided:
  • A list of impacted checks and posture check recommendations.
  • The destination address displayed in a side panel.