Change the priority of Incident Case elements

As the investigation of the incident progresses, you can change the priority of the Incident Case as necessary.

The default Priority of an incident case is Low when an incident case is created. The priority you define is for your own categorization and does not affect the way the case is handled in the SMC.

  For more details about the product and how to configure features, click Help or press F1.

Steps

  1. Right-click the Incident Case you want to change the priority for and select Properties.
  2. Select the new Priority and click OK.

Incident Case Properties dialog box

Use this dialog box to define the properties for an Incident Case.

Option Definition
Name The name of the element.
Comment

(Optional)

 A comment for your own reference.
State
  • Open — The incident case has been created, but investigation has not begun.
  • Under Investigation — The incident case is actively being investigated.
  • False Positive — Legitimate activity was incorrectly interpreted as suspicious. There is actually no incident.
  • Closed — The investigation is finished.
Priority

(Optional)

Adds a priority rating for your own reference.