Incidents provides a centralized solution for managing
incidents across Palo Alto Networks products: Next-Generation Firewalls (NGFW) and
Prisma Access. The incident framework aggregates incident data, offering a consolidated
view for monitoring, troubleshooting, and resolving issues impacting network
availability, security posture, and performance.
An incident is a current or emerging degradation in availability, security
posture, or performance requiring your action. Incidents provides
the following capabilities:
Display the total number of open incidents.
Provide breakdowns of incidents by product type, category, severity,
and priority.
Track trends in incident creation and resolution.
Show operational status and assigned operators.
Each incident includes the following fields:
ID, title, severity, priority, and state
Product category and subcategory
Impacted objects
Remediation information
Some of the incidents contain the root cause information along with
remediation.
Timestamps and history
The incident framework aims to provide a comprehensive solution for incident
management with features varying by license tier, focusing on providing IT admins with
the tools to effectively monitor and respond to issues in their deployments.
Here’s the data shown under Summary:
RAISED PAST 24H: Displays the number of incidents raised in the
last 24 hours and the preceding 24-hour period.
CLEARED PAST 24H: Displays the number of incidents cleared in
the last 24 hours and the preceding 24-hour period.
SUPPRESSED PAST 24H: Displays the number of incidents suppressed
in the last 24 hours and the preceding 24-hour period.
RECOMMENDED ACTIONS: Provides suggestions for optimizing
incident management, including:
Setting up default notification profiles
Configuring incident parameters
Improving operational health
BY SEVERITY: Categorizes incidents by severity (Critical, High,
Warning, and Informational) and displays the count for each.
Click the counts within the widgets to apply a filter to
display only the corresponding incidents. For example, click the count next to
Critical to filter the view to show only critical incidents.
Alternatively, you can use the filters on the page to focus on specific
incidents.
BY PRODUCT: Categorizes incidents by product type.
BY PRIORITY: Categorizes incidents by priority with P1 being the most
severe.
BY CATEGORY: Categorizes incidents by category. You can further
drill down to the device sub category.
INCIDENT TREND: Displays a historical graph of incident trends
over time. Hover over the graph to view the number of incidents raised, cleared,
and newly raised at specific points in time. Use the drop-down to select the
desired time range.
A tabular view of all incidents is available with the following
functionalities:
Expand to view only the table.
Perform actions:
Acknowledge or Unacknowledge: Toggle the
acknowledgment status of an incident.
Add Comment: Add comments to an incident.
Manually Clear: Manually resolve and clear an
incident.
Click an incident to view its details.
Customize displayed columns and their order.
View Incident Details
From Incidents, select an incident to open a page with the following
details about it.
Description: Comprehensive details of the incident,
including:
Primary impacted objects
Related objects
Priority: Ability to set or modify the incident
priority.
Raised time: The timestamp when the incident was
created.
Last updated: The timestamp of the last modification
to the incident.
More: Provides additional information such as
Category, Sub-category, Raise Conditions, and Clear Conditions.
Acknowledge or unacknowledge actions are also available here.
Evidence: A list of devices impacted by the incident.
Remediation: Recommendations and resources for resolving the
issue.
Activity Log: A chronological record of notifications sent,
comments, parent, child, and related incidents, and recent occurrences.
For posture-related incidents, the following additional information is
provided:
A list of impacted checks and posture check recommendations.
The destination address displayed in a side panel.