{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":45023,"path":"security-management/security-incident-response/t_CmpsPstIncdRvwQtns.md","title":"Compose post incident review questions","bundle":null,"doc_type":null,"release":"australia","body":"\n# Compose post incident review questions\n\nYou can use the post incident review questions that come with the base system or create your own questions.\n\n## Before you begin\n\nRole required: sn\\_si.admin\n\n## About this task\n\nThe methods for gathering post incident review information can be in the form of questions or as data automatically collected using scripts.\n\nQuestions can depend on the answers to other questions. For example, you might ask if all necessary logs were available. If the answer is No, you ask a follow-up question to ascertain which of the needed logs weren’t enabled.\n\nScripted data collection, also called script metrics, gather data related to the security incident via scripts you write. This action can go well beyond the data in the security incident record itself. For example, a script metric could gather the recent outage time for a server affected by this security incident.\n\nFinally, you can mix the two types. Questions can have default values taken from a script, or simply from a field in the security incident record. When you use a `Default Answer from…` type of question, you can choose if you want the user to always answer the question – with the default value providing them with an initial value. Or you want the user only to be asked the question if the script or field comes up empty.\n\nTo create a question:\n\n## Procedure\n\n1.  Navigate to **All** &gt; **Security Incident** &gt; **Post Incident Review - Assessments Setup**.\n\n2.  In the **Assessment Questionnaire Configurations** section, select **Configure**.\n\n    A list of questionnaire categories opens.\n\n3.  Select the category for which you want to create a new question.\n\n4.  Select the **Assessment Metrics** tab.\n\n5.  Select **New**.\n\n    You can also select an existing question to modify it.\n\n6.  Fill in the fields on the form, as appropriate.\n\n<table id=\"table_qvm_fbd_3t\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\nName of the metric \\(question or script\\). If the metric is a scripted data collection, this name appears on the post incident report.\n\n</td></tr><tr><td>\n\nCategory\n\n</td><td>\n\nThe category that the metric belongs to. The system automatically populates this category if you create a new metric from the Metric Category form. **Note:** You can’t change the category if the **Depends on** field is set or if another metric depends on this metric\n\n</td></tr><tr><td>\n\nMethod\n\n</td><td>\n\nIndicates the type of metric, as follows:\n\n-   **Assessment**: A question that has no default value. There are several data types that can be defined in the **Data Type** field on the **Field Type** tab, such as check boxes, choice lists, text input.\n-   **Script**: Scripted metric. Obtain values by writing a custom script. The **Script** method is compatible with the **Duration**, **Number**, and **Percentage** data types.\n-   **Default answer from field**: A question where the default response comes from a selected field in the security incident. Selecting this option adds two fields to the **General** tab:\n    -   **Default answer**: Select the field in the security incident that contains the default answer for the question. For example, for the question: \"Who initially reported this incident?\", the **Requested by** field would be a likely choice.\n    -   **Ask question**: Specifies when to ask the question: always or only if the **Default answer** field is empty. Using the example above, the question would be asked if the **Requested by** field is empty.\n-   **Default answer from script**: A question where the default answer comes from a script. The answer may be a number, string, or percentage. The **General** tab adds a field:\n\n**Ask question**: as the Specifies when to ask the question: always or only if the script doesn’t provide a default answer. The script is defined on the **Field Type** tab.\n\n **Note:** If you select a **Data type** that is incompatible with the selected **Method**, the system automatically changes the **Method** to a compatible value.\n\n</td></tr><tr><td>\n\nWeight\n\n</td><td>\n\n\\[Required\\] Numeric value that represents the importance of this metric relative to other metrics in the same category. By default, the weight is 10.\n\n This field is visible and required unless the **Data type** is **Date**, **Date/Time**, or **String**. These data types aren’t included in results calculations.\n\n</td></tr><tr><td>\n\nOrder\n\n</td><td>\n\n\\[Required\\] Numeric value that determines the order of the metric question on assessment questionnaires, relative to other metric questions in the same category. The metric with the smallest order value appears as the first question in the category section. By default, the order is 100.\n\n**Note:** It doesn’t matter which order value you use for metrics with the Script method, as they don’t appear on questionnaires.\n\n</td></tr><tr><td>\n\nActive\n\n</td><td>\n\nCheck box that determines whether this metric is used. If the check box isn’t selected, it’s as if the metric record doesn’t exist.\n\n</td></tr><tr><td>\n\nMandatory\n\n</td><td>\n\nCheck box that makes the metric question mandatory \\(selected\\) or optional \\(cleared\\) on assessment questionnaires. Users can't submit questionnaires until they provide valid responses to all mandatory questions, which are denoted by a red field status indicator.\n\n This field is visible only if the **Depends on** field is empty, and the data type isn’t **Checkbox**.\n\n</td></tr></tbody>\n</table>7.  Select the **General** tab and fill in the fields, as appropriate.\n\n<table id=\"table_swb_mcd_3t\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nQuestion\n\n</td><td>\n\nText to use as the question on security incident review questionnaires. Enter a clear, straightforward question that is easy to answer, such as **How did we contain the incident**\n\n</td></tr><tr><td>\n\nDescription\n\n</td><td>\n\nInformation about the metric and what it evaluates. If the **Method** is **Assessment**, include details that help users understand how to answer the question. This text appears as a tooltip when a user hovers over the question text on the questionnaire.\n\n</td></tr><tr><td>\n\nDepends on and Displayed when\n\n</td><td>\n\nSelect a question in the **Depends on** field that the current question depends on. For example, the question, \"What additional logs were needed?\" depends on the question \"Were all needed logs available?\"\n\n Next, use the **Displayed when** field to identify when you want the dependent question to appear in questionnaires. For example, if you want the dependent question to be asked only when the user answers **No** to the \"Were all needed logs available?\" question, select **No** in the **Displayed when** field.\n\n **Note:** The system helps to prevent the creation of recursive dependencies between metrics. For example, if Metric A depends on Metric B, Metric B can’t depend on Metric A.\n\n</td></tr></tbody>\n</table>8.  Select the **Field Type** tab and fill in the fields, as appropriate.\n\n<table id=\"table_ybl_pdd_3t\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nData type\n\n</td><td>\n\nThe data type of the expected response the list of types available depends on for the selected method. If the method is **Assessment**, the data type determines how users answer the corresponding question on questionnaires. If the method is **Script**, the data type determines how the system calculates assessment results.**Note:** If another metric depends on this metric, you can’t change the data type.\n\n</td></tr><tr><td>\n\nRandomize answers\n\n</td><td>\n\nCheck box that determines whether to present the answer options for this metric question in a random order each time a user opens an assessment questionnaire that contains the question. Answer preference can be influenced by the order in which answer options appear. This can result in biased results. Randomizing answer options can help prevent this bias.\n\n This field is visible only if you select **Likert scale** or **Choice** in the **Data type** field.\n\n</td></tr><tr><td>\n\nDependent plugin\n\n</td><td>\n\n\\[Required if the **Method** is **Script**.\\]Plugin that contains the tables queried in the script. The system executes the metric script only if the plugin is active. The default available values are **Asset Management**, **CMDB**, **Core**, **Cost Management**, **Procurement**, and **Software Asset Management**.\n\n This field is visible only if the **Method** is **Script**.\n\n **Note:**\n\n-   If the Core default value is used, the script is always run.\n-   If you’re an administrator, you can add more choices of plugins to the field.\n\n\n</td></tr><tr><td>\n\nScale definition\n\n</td><td>\n\nSetting that determines whether lesser or greater numerical values equate to a good score in assessment result calculations. Select **Low** if lesser numerical values are better, such as for a metric that measures the number of defects for a vendor. Select **High** if greater numerical values are better, such as for a metric that measures user satisfaction on a scale of one to five. The default value is **High**.\n\n This field is visible and required unless the **Data type** is **Date**, **Date/Time**, or **String**. The results for these data types aren’t included in results calculations.\n\n</td></tr><tr><td>\n\nMin\n\n</td><td>\n\nLowest numerical value to be used as an answer option on assessments or as a scaled value in a scripted metric.\n\n This field is visible and required only if certain data types are selected. If the data type is **Choice** or **Likert Scale**, this field is read only and is set automatically based on the smallest metric definition **Value**.\n\n</td></tr><tr><td>\n\nMax\n\n</td><td>\n\nHighest numerical value to be used as an answer option or scaled value.\n\n This field is visible and required only if certain data types are selected. If the data type is **Choice** or **Likert Scale**, this field is read-only and is set automatically based on the largest metric definition **Value**.\n\n</td></tr><tr><td>\n\nScript\n\n</td><td>\n\nScript that obtains the desired system information. The script has one input variable, set with the ID of the security incident \\(primary\\), and three possible output variables set by the script, string\\_result, scaled\\_result, and actual\\_result. When the data type is String, only the string\\_result is required.\n\n This field is visible and required when the **Method** is **Script**, or the default value comes from a script.\n\n</td></tr><tr><td>\n\nTemplate\n\n</td><td>\n\nA predefined set of common answers to use for the question. For example, a frequency template would likely start with a value of \"Never,\" and go up to the top value of \"Always.\"\n\n This field is visible and required only if the **Data type** is **Template**.\n\n**Note:** If another metric depends on this metric, you can’t change the template.\n\n</td></tr></tbody>\n</table>9.  When you have completed your entries, select **Update**.\n\n\n"}}