The Incident Owner is responsible for opening investigations and assigning investigators.
To document an investigation on an incident:
Go to the My Tasks page.
- Click an incident in the Under Investigation state to open the Incident Review form.
- Complete the following fields in the Incident General Details section as needed:
- Incident Start DateTime and Incident End DateTime: When the incident began and when it ended.
- Incident Flags: High-risk and important incident details, with a related symbol for easy reference.
- Description: Details of the investigation or incident.
- Complete the Investigation Start Date and Investigation Close Date, as needed.
- Complete the fields in the remaining Logs, Interviews, Evidence, Links, Outcomes & Root Cause, Attachments, and Incident Properties tabs. Note that your user group may not be permitted to complete all fields.
- Click one of following buttons:
- Return: Returns the incident back to the incident owner in the Open state.
- Complete Investigation: Closes the incident because no further action is required. The incident can be viewed and reopened by the Incident Owner and the Incident Supervisor. See View and Reopen a Closed Incident for more information.