{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44890,"path":"security-management/security-incident-response/security-incident-details-form.md","title":"Security incident Details tab","bundle":null,"doc_type":null,"release":"australia","body":"\n# Security incident Details tab\n\nThis section describes all the fields of the **Details** tab of a security incident.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nNumber\n\n\n\n\\[Read only\\] The security incident number.\n\n
\n\nRequested by\n\n\n\nThe person requesting the work to be performed.\n\n
\n\nConfiguration Item\n\n\n\nThe server, computer, router, or other configuration item affected by the security issue.\n\n
\n\nAffected user\n\n\n\nThe person affected by the security issue.\n\n
\n\nLocation\n\n\n\nThe location of the requester or resource. If a **Configuration Item** isn’t selected, this field is pre-filled with the location of the requester.\n\n
\n\nCategory\n\n\n\nThe category that identifies the type of security issue.If a category is selected, a workflow for analyzing this issue is executed when the record is saved. For example, if you select **Denial of Service**, the Security Incident - Denial of Service - Template workflow is executed.\n\n For more information, see [Security Incident Response workflow templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/sir-orch-workflow-templates.md).\n\n
\n\nSubcategory\n\n\n\nThe subcategory that further defines the issue.\n\n
\n\nOpened\n\n\n\n\\[Read only\\] Displays the date and time the incident was opened.\n\n
\n\nState\n\n\n\nThe current state of the security incident. Upon security incident creation, this field defaults to **Draft**.\n\n
\n\nSubstate\n\n\n\nIdentifies whether the security incident includes a pending problem or change.\n\n
\n\nSource\n\n\n\nIdentifies the source of the security incident, such as email, a phone call, or network monitoring.\n\n
\n\nAlert Sensor\n\n\n\nSecurity integration through which you ingest the alert or event data such as CarbonBlack, CrowdStrike, McAfee.\n\n
\n\nAlert Rule\n\n\n\nThe rule in the security product, which triggered the creation of this security incident.\n\n
\n\nRisk score\n\n\n\nDisplays the risk score calculated for this security incident. The value is based on the priority of the security incident, the type of security incident \\(Denial of Service, Spear Phishing, or Malicious code activity\\), and the number of sources that triggered a failed reputation score on an indicator. The risk score aids in prioritizing security incident work for analysts. Three security incident properties allow you to further designate a color-coded dot to appear next to the risk score in list view to make them more easily identifiable.\n\n If you change certain fields in the security incident, such as the **Business impact** or **Priority**, and save the record, the **Risk score** is automatically recalculated and displayed. The change is also reflected in the work notes and on the Risk Score Audits related list.\n\n**Note:** The risk score is also recalculated when affected users are associated with a security incident, affected services, or vulnerable items.\n\n You can also manually enter a new **Risk score**. This can be useful if you want to keep a particular security incident at the top of the list of security incidents you’re analyzing. If you enter a new **Risk score**, the **Risk score override** check box is automatically selected. Regardless of the changes made in the security incident, a manually-entered risk score isn’t automatically recalculated.\n\n**Note:** If you have upgraded your instance from a prior release, risk scores were calculated for all of your open security incidents. For more information, see [Understanding security incident calculators](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/setup-assistant-reference.md).\n\n
\n\nRisk score override\n\n\n\nOption to override the automatic update of the risk score. The override is reflected in the work notes.\n\n
\n\nExternal risk score\n\n\n\nThe calculated external risk score.\n\n
\n\nBusiness impact\n\n\n\nImportance of this security incident to your business. The default value is Non-critical. If, after the security incident record has been saved, you change the value in the **Priority** and/or **Risk** fields, the **Business impact** is recalculated.\n\n
\n\nFunctional Impact\n\n\n\nThe functional impact of this security incident. For example, service downtime, business disruption.Following are the options:\n\n- Low\n- Medium\n- High\n\n**Note:** This field isn’t available in the base system. To add this field, see [Accessing Form Builder](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/application-development/access-form-builder.md).\n\n
\n\nRecoverability\n\n\n\nHow easily and quickly you can restore the normal operations and recover from the impact of the security incident. Following are the options:- Regular\n- Supplemented\n- Extended\n- Not Recoverable\n\n**Note:** This field isn’t available in the base system. To add this field, see [Accessing Form Builder](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/application-development/access-form-builder.md).\n\n
\n\nInformation Impact\n\n\n\nThe data impact of the security incident. You can select all the applicable:- Privacy Breach\n- Proprietary Breach\n- Integrity Loss\n\n**Note:** This field is not available in the base system. To add this field, see [Accessing Form Builder](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/application-development/access-form-builder.md).\n\n
\n\nPriority\n\n\n\nThe order in which to address this security incident, based on the urgency. If this value is changed after the record is saved, it can affect the **Business impact** calculation.\n\n
\n\nAssignment group\n\n\n\nThe group to which this security incident is assigned.\n\n
\n\nAssigned to\n\n\n\nThe individual assigned to analyze this security incident. Assignments can be performed manually or automatically. For more information, see [Assigning security analysts](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/r_AgentAssignment.md).\n\n
\n\nShort description\n\n\n\nA brief description of the security incident.\n\n
\n\nKnowledge results\n\n\n\nAs you enter the short description, links to related articles from the knowledge base appear. Scanning the information could solve your issue.\n\n
**Parent Topic:**[Security Incident Details section](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/security-incident-details.md)\n\n"}}