| \n\nField\n\n | \n\nDescription\n\n |
|---|---|
| \n\n**Lifecycle**\n\n | |
| \n\nWork notes are required to close or cancel a request or task\n\n | \n\nEnable this option to require the user to enter work notes before a security incident or response task can be closed or canceled.\n\n |
| \n\nCopy task work notes to request\n\n | \n\nEnable this option to synchronize response task work notes with the work notes on the security incident. So when work notes in the task are added, the same work notes appear in the parent security incident.\n\n |
| \n\n**Catalog and Request Creation**\n\n | |
| \n\nCreate or update requests by inbound email\n\n | \n\nEnable this option to create or update security incidents from inbound emails.\n\n |
| \n\nRequests are created using\n\n | \n\nSelect **catalog or regular form** to activate the catalog and enable automatic publishing of security incident templates to the catalog.Select **regular form only** to deactivate the catalog and disable automatic publishing of security incident templates to the catalog.\n\n |
| \n\nTemplates create a dedicated catalog item\n\n | \n\nEnable this option to activate automatic publishing of catalog items for the application.\n\n |
| \n\n**Notifications**\n\n | |
| \n\nFor a request or task, when the selected field changes, send notification to recipients\n\n | \n\nYou can configure notifications to be sent to specific recipients when selected fields in security incidents and response tasks change. 1. From **Table**, select **Request \\(security incident** or **Task \\(response task\\)**.\n2. From **Field**, select the field to use for generating notifications. When a change is made to the selected field, a notification is sent to the identified recipients.\n3. From **Recipients**, select one or more recipients.\n4. If you select **a specific user** or **a specific group**, you are prompted to select a user or group.\n5. To define more notifications using other fields or recipients, repeat the preceding steps for the next set of notification settings.\n6. To remove a notification, select the \\[Omitted image \"DeleteNotification.png\"\\] Alt text: delete notification symbol icon to the right of the notification.\n\n\n |
| \n\nField\n\n | \n\nDescription\n\n |
|---|---|
| \n\nAssignment method for requests\n\n | \n\nSelect the method for assigning security incidents:- **using auto-assignment**: Security incidents are automatically assigned.\n- **using a workflow**: Security incidents are assigned by the selected workflow.\n- **manually**: Security incidents are manually assigned.\n\n\n |
| \n\nUse this workflow to assign requests\n\n | \n\nSelect the workflow for dispatching security incidents. This field appears when **using a workflow** is selected from the **Assignment method for requests** list.\n\n |
| \n\nAssignment method for tasks\n\n | \n\nSelect the method for assigning response tasks:- **using auto-assignment**: Response tasks are automatically assigned.\n- **using a workflow**: Response tasks are assigned by the selected workflow.\n- **manually**: Response tasks are manually assigned.\n\n\n |
| \n\nUse this workflow to assign tasks\n\n | \n\nSelect the workflow for assigning response tasks. This field appears when **using a workflow** is selected from the **Assignment method for tasks** list.\n\n |
| \n\nAssign requests or tasks based on assignment group coverage areas\n\n | \n\nEnable this option to limit the assignment of security incidents and response tasks to groups that cover the location of the task.\n\n |
| \n\n**Scheduling**\n\n | |
| \n\nAuto-selection of agents consider time zone for tasks\n\n | \n\nEnable this option to consider the time zone of the agent when assigning a task. This field appears when auto-assignment is selected for security incidents or response tasks.\n\n |
| \n\n**Additional Factors**\n\n | |
| \n\nAuto-selection of agents consider location of agents\n\n | \n\nEnable this option to give preference to agents who are closer to the task location, when assigning any tasks. This field appears when auto-assignment is selected for security incidents or response tasks.\n\n |
| \n\nAuto-selection of agents for tasks requires them to have skills\n\n | \n\nSelect the degree to which agent skills must be matched to a task when determining auto-assignment. - Select **all** to require that an assigned agent must have all the skills to perform the task. An agent who lacks even one skill is eliminated.\n- Select **some** if you want agents who have most of the skills required to perform the task.\n- Select **none** if you want to auto-assign agents without taking skills into account. This field appears when auto-assignment is selected for security incidents or response tasks.\n\n\n |
| \n\nAuto-selection attempt to assign the same agent to all tasks in a request\n\n | \n\nEnable this option to auto-assign all response tasks for a security incident to the same agent.\n\n |
| \n\nTest\n\n | \n\nDescription\n\n | \n\nRelease version\n\n |
|---|---|---|
| \n\nSIR: Create Security Incident\n\n | \n\nDetermine whether a user can successfully create a security incident from the security incident form.\n\n | \n\nMadrid\n\n |
| \n\nSIR: Create Security Incident via Security Incident Catalog\n\n | \n\nDetermine whether a user can successfully create a security incident from the catalog.\n\n | \n\nMadrid\n\n |
| \n\nSIR: PIR Assessments OOTB configuration test\n\n | \n\nUse this test to validate PIR assessments and base system configurations.\n\n | \n\nTokyo\n\n |
| \n\nSIR: PIR Assessments conditional Configuration tests\n\n | \n\nVerify that security incidents matching the mandatory conditional rule are not closed without completing the post incident assessment.\n\n Verify that the security incidents matching the optional conditional rule can be closed without completing the post incident assessment.\n\n Verify that assessments are not generated for the security incidents that do not match any rule.\n\n | \n\nTokyo\n\n |
| \n\nSIR: PIR Run Time Experience\n\n | \n\nVerify that PIR reports are configured and attached to the security incidents as per the new design.\n\n | \n\nTokyo\n\n |
| \n\nSIR: PIR Design Time Experience\n\n | \n\nVerify that the security incident is mapped with the report template based on the administrator configuration.\n\n | \n\nTokyo\n\n |
| \n\nSIR: Link Security Incident to a existing Major Security Incident\n\n | \n\nLink a Security Incident to an existing Major Security Incident and validate data from Security Incident rolled up to Major Security Incident.\n\n | \n\nTokyo\n\n |
| \n\nSIR: Promote Security Incident as Major Security Incident\n\n | \n\nPromote a Security Incident as Major Security Incident and validate data from Security Incident rolled up to Major Security Incident.\n\n | \n\nTokyo\n\n |
| \n\nSIR: Propose Security Incident as Major Security Incident\n\n | \n\nPropose a Security Incident as Major Security Incident and validate data from Security Incident rolled up to Major Security Incident.\n\n | \n\nTokyo\n\n |
| \n\nSIR: Security Incident life cycle\n\n | \n\nValidate a Security Incident life cycle with the policy violation response tasks workflow.\n\n | \n\nYokohama\n\n |
| \n\nSIR: Create Security Case\n\n | \n\nCreate a Security Case from the Security Incident form.\n\n | \n\nYokohama\n\n |
| \n\nVerify that only Allowed Members can access the security incident once Enforce Restriction is ON\n\n | \n\nVerify that only the allowed members can access the security incident once the Enforce Restriction is enabled.\n\n | \n\nYokohama\n\n |
| \n\nVerify that security incident enabled with \"Enforce Restriction\" is not visible for any user\n\n | \n\nVerify that security incident enabled with \"Enforce Restriction\" is not visible for any user.\n\n | \n\nYokohama\n\n |
| \n\nValidate Read Access\n\n | \n\nValidate the view access.\n\n | \n\nYokohama\n\n |
| \n\nValidate Write Access\n\n | \n\nValidate the edit access.\n\n | \n\nYokohama\n\n |
| \n\nSIR Workspace: Read Access\n\n | \n\nVerify that Read Access user can view the security incident without having security roles even on workspace.\n\n | \n\nYokohama\n\n |
| \n\nSIR Workspace: Write Access\n\n | \n\nVerify that Write Access user can update the security incident without having security roles.\n\n | \n\nYokohama\n\n |
| \n\nSIR Workspace: Create new Security Incident\n\n | \n\nCreate new security incident from workspace.\n\n | \n\nYokohama\n\n |
| \n\nSIR Workspace: Create Response Task\n\n | \n\nCreate new response task from an existing security incident.\n\n | \n\nYokohama\n\n |
| \n\nNow Assist for Security: Active Security Incident Summarization\n\n | \n\nSummarize an active security incident and validate the displayed sections.\n\n | \n\nZurich\n\n |
| \n\nNow Assist for Security: Security Incident Summarization\\_Share to worknotes\n\n | \n\nShare the generated summary to worknotes.\n\n | \n\nZurich\n\n |
| \n\nNow Assist for Security: Closed Security Incident Summarization\n\n | \n\nSummarize a closed security incident and validate the displayed sections.\n\n | \n\nZurich\n\n |