Triage an Incident

These instructions are for accessing incidents in the Triage state from the Incident Management application. Note that Incident Screener user group members can also view and open incidents from their homepage (i.e., My Tasks).

To triage an incident:

When incidents are submitted through the portal, Incident Screeners are emailed a direct link to the Triage form (in that case, proceed to step 4 below).
  1. Log into a user account from the Incident Screener user group.

  2. Click the dropdown in the nav bar Incident Management to display the Triage activity.The nav bar.
  3. Click an incident in the Submissions section to display it.The Triage activity of Incident Management.
  4. Optional: Click the incident heading (e.g., INC-571: 2021 - Security Breach) to make changes, then click away from the title to save it.
  5. Optional: Click the x next to the incident type to use a different primary incident type (i.e., not the one selected by the submitter).
    you used a different primary incident type (or if there is not one already selected)
    click Add Existing Primary Incident Type. Begin typing the relevant incident type in the search bar and click + Add.
    the selected incident type requires a Business Unit, Region or Market
    follow the above steps for the Business Unit, Region, or Market field, then click to select the relevant objects.
    Select an incident type to determine the remainder of the required fields on the form.
    Depending on the selected incident type and the available form fields’ order, your process may differ from the steps below.
  6. In the Classification section, select from the Severity field. 
    • Selecting Based on Incident... will auto select a severity based on the relevant incident type.
  7. Select from the Observed DateTime field.
  8. Select from the Incident Start DateTime field.
  9. To create a new involvement, click the + icon below Involved People, Location(s), Organization, Items/Assets, or Vehicles to open the creation palette, then complete the fields as required.The Add a New Involved Location palette.
  10. Optional: Complete the Description field.
  11. Optional: Click Create New under Linked Incidents to open the creation palette, then complete the fields as required.The Linked Incidents palette.
  12. Enter any additional Incident Submitter instructions in the Triage Notes text box. 
  13. Define who must access the incident object by selecting users or user groups in these Access section fields:
    • Incident Owner: Creates and/or edits their assigned incident objects and related relationship objects. The user(s) will receive an email notification once they're assigned an incident and it's opened for the first time.

    • Incident Supervisor: Fully manages the incident objects in the Archive or Review state.

    • Additional Access: Defines additional users or groups who may need to access the incident.

    • Investigator: Documents incident investigations.

    • Security Officer: Creates, monitors and updates incidents with officer-specific functionalities (limited workflow and details).

    • Incident Contributor: Contributes data to existing incidents (e.g., being assigned tasks, adding attachments), when invited to do so 

    • Incident Approver: Advances the workflow of a particular incident, providing reviews and approvals, gets assigned specific tasks.

  14. Optional: In the form header's Communications tab, you can enter Comments in the text box, tagging other users if needed. Read more here: Incident Form Comments.
  15. Click one of the following buttons:
    • Close: No further action is required and the incident closes.

    • Return: The incident returns to the submitter in the Draft for additional information.

    • Mark As Open: The incident is sent for further action to the user(s) in the Incident Owner field. Additional fields on the incident form.