Triage an Incident

The following provides instructions for accessing incidents in the Triage state from the Incident Management application; however, members of the Incident Screener user group can also view and open these incidents from the homepage (My Tasks).

To triage an incident:

Incident screeners receive emails when incidents are submitted through the portal. Click the link in the email to go directly to the Triage form and skip to step 4.
  1. Log into a user account that's been added to the Incident Screener user group.

  2. Click the dropdown in the nav bar Incident Management to display the Triage activity.The nav bar.
  3. Click an incident in the Submissions section to display it.The Triage activity of Incident Management.
  4. Optional: Click the title of the incident (e.g. INC-2019-12-03-6 Physical Security) to make changes as needed, then click away from the title to save your changes.Clicking the name of the incident object will allow you to make changes as needed.
  5. Optional: Click the  icon and select Create [Language] Translation to translate the submitted data to your default language. To revert a specific field back to its original language, click the  icon next to the desired field.
  6. Optional: If you wish to use a different primary incident type other than the one selected by the submitter (if they chose one), click the x next to the incident type.
  7. Optional: If you have completed step 6 above, or if there is no primary incident type already selected, click Add Existing Primary Incident Type. Begin typing the desired incident type in the search bar and click + Add.Selecting an incident type, which will determine the remainder of the fields that will need to be completed on the form.
    Depending on the incident type chosen, the fields available on the form, as well as the order in which they appear, may differ from the steps below.
  8. If the selected incident type requires a business unit, region or market follow steps 6 and 7 above for the Business Unit, Region or Market field, then click to select it.
  9. Select the severity of the incident from the Severity field. Selecting Based on Incident... will auto-select a severity based on the chosen incident type.
  10. Select a start date and time for the incident from the Incident Start DateTime field.
  11. To create a new involvement, click the + icon below Involved [Location(s), People, Organization, Items/Assets, or Vehicles] to open the creation palette, then complete the fields as required.The Add a New Involved Location palette.
  12. Optional: Enter a description in the Description field.
  13. Optional: Click Create New under Linked Incidents to open the creation palette, then complete the fields as required.The Linked Incidents palette.
  14. Complete the fields in the UDFs section as required.
  15. Define who should be able to access the incident object by selecting users or user groups in the following fields in the Access section:
    • Incident Owner: Creates and/or edits the incident objects assigned to them, as well as the appropriate relationship objects. An email notification is sent to the user(s) once an incident is assigned to them and opened for the first time.

    • Incident Supervisor: Fully manages the incident objects that are in the Archive or Review state.
    • Additional Access: Additional users or groups who may need to access the incident.
    • Investigator: Documents incident investigations.
  16. Enter any notes, including any additional instructions to the incident submitter, in the Triage Notes text box. 
  17. Enter comments, tagging other users if needed, in the Comments text box (at the bottom of the page). See the Incident Form Comments article for more information on using this feature.
  18. Click one of the following buttons:
    • Return: Returns the incident back to the submitter in the Draft for additional information.

    • Close: Closes the incident because no further action is required.
    • Mark As Open: Sends the incident to the user(s) in the Incident Owner field for further action. Additional fields on the incident form.