Managing Incidents in the Incident Console

Managing your open incidents in the Alert Logic® console for Alert Logic Essentials, Professional, or Enterprise customers within the navigation menu () at Respond > Incidents, and for Alert Logic Cloud Defender or Threat Manager customers at Incidents - is an important part of maintaining a secure environment for your company. The Incident Console is your hub for all things incident management. 

Once you understand the tool that you will use to manage your incidents, you should be familiar with the workflow built into the Incident Console to work on your incidents, which we recommend that you utilize. All generated incidents start in the Open incidents list. Work your open incidents. If you have not completed remediation of an incident and want to put it on hold and come back to it, you can move it to the Snoozed incident list. When you have completely remediated the incident, moved it to the Closed incident list.

The following article provides best practice suggestions on how to most effectively work your incidents to manage and ultimately remediate all your open incidents.

Review Every Day

Alert Logic recommends that you spend some time reviewing your open incidents every day. The goal is to maintain an empty Open incident list, which means that you should work all of your incidents, and often. Of course, some incidents are more important than others - hence the assigned security levels. See the Review Critical and High Threat Incidents First section below for suggestions on working your incidents by severity level.

Review Critical and High Threat Incidents First

Alert Logic recommends that you handle incidents in the order of their severity, with critical and high severity incidents being managed first. Utilize the Organize by Threat Level option at the top of your incident list to sort your incidents from highest threat to lowest.

Critical and high threat incidents should not only be handled first, but ideally immediately - within a couple of hours of notification - as well. Subscribe to incident escalation notification emails to be notified as soon as these incidents are generated.

Once critical and high threat incidents have been successfully remediated, move onto medium severity incidents. Work medium incidents by date, starting with the oldest first. Filter your incident list with the Threat Level filter category to only show you medium incidents. Scroll to the bottom of the list of medium incidents to start remediating the oldest first. Alert Logic recommends that you review open medium incidents within 24 hours of generation.

Note: If you have open incidents that were generated over a month ago, utilize the date range drop-down at the top right of the page to extend your time frame and the list of incidents past the automatic date filter of one month.

Finally, work low severity incidents as you worked medium severity incidents before them. Filter your list to show you only low incidents and start from the bottom of the list up. Alert Logic recommends that you work low incidents within a week of generation.

Ultimately, all incidents should be remediated. Alert Logic recommends that you spend time on your incidents each week until they are all closed. If this goal seems unattainable for your team with the number of incidents that you receive, see the Tune Out Unnecessary Incidents section below for suggestions on cutting down on incidents that may be unnecessarily generated.

Snooze Incidents

When you snooze an incident, it is removed from the Open incident list. This function clears away the clutter of incidents that you currently are not able to remediate so that you can focus on actionable incidents.

The most common use case for snoozing an incident is when you have begun work on it but are waiting on a third-party resource to complete an action that will allow you to work on the incident further. Remove it from your Open incident list while also setting a time frame in the future for it to reappear in your Open list, at which point you can continue to work on it without blockers. Be sure to write yourself a note on why you are snoozing your incident so that when it reappears in the Open incident list you will remember what you have done and what needs to be done next.

Note: Snoozing an incident is different that updating an open incident with notes because it removes the incident from your Open incident list and brings it back after a set amount of time. Updating an incident keeps it in your Open incident list and on your current to-do list.

Utilize Bulk Actions

Bulk actions can help you quickly and efficiently manage several incidents at once. Learn how to perform bulk actions with the Bulk Actions section of our Incident Console Features knowledge base article. Utilize the following list of potential use cases to get inspiration on how to use bulk actions in your environment:

• A type of incident has a compensating control in place or is an acceptable risk that you know you don't need to work
• An originating incident that you have successfully remediated has spawned several directly related incidents - make sure to confirm the originating IP of these incidents
• Known activity is generating several incidents that do not need to be worked

Tune Out Unnecessary Incidents

If managing all your incidents every day or week sounds daunting or even impossible due to the number of incidents that are generated in your environments, it may be time to tune out incidents that require less oversight.

The Utilize Bulk Actions section may be a good place to start in identifying incidents that you would like to be tuned out. Once you have identified the types of incidents you want tuned out, open a ticket with our Support team. Provide as much detail as possible, including example incidents, frequency of incidents, payload information, and last occurrence of that type of incident.

Making the number of incidents you need to work more manageable will allow you to focus on those incidents that are more important to the security of your environments.