Incident Form

Ticket Data

• Id: Corresponds to the name or identifier of the Indicator or Problem that has been generated.

• Subject: This field defines the title of the Indicator or Problem.

• Description: This is one of the most important points, as it is through this field that the Incident or Problem is specified in as much detail as possible.

• Registration Date: Communication date.

• Type: Allows determining whether the event being defined is an Incident, a Problem, an Event, or a False Positive.

It is through the dropdown shown in the image where the type of event being registered is determined.

• Status: Depending on whether the record is an Incident or a Problem, the dropdown provided by GlobalSUITE will be different.

Below are the types of statuses in which an Incident can be found.

On the other hand, if it is a problem, GlobalSUITE provides the following options for the specific case of a Problem.

• Services: This field will associate the services affected by the Incident or Problem.

All the fields identified above are those that will appear in the information received by the client if the Incident or Problem has been communicated through the Client Portal via a Ticket.

GlobalSUITE also allows defining the following information for Incidents and Problems:

• Client/Source: If it has been opened from the portal, this field will be automatically completed. If it is opened manually, the solution allows establishing the source.

• Contact: If it has been generated from the client portal, the contact will correspond to the person responsible for generating the event. This contact field is editable, allowing another user to be specified to inform about the status of the Incident or Problem.

If it has been generated manually, this field will indicate who should be contacted to inform about the status of the Incidents and Problems.

• E-mail: The email to which the status can be communicated is indicated.

• Alert Changes: By selecting this option, GlobalSUITE®® will send information about status changes and classifications made to the email indicated in the field above.

• NOTE: If a mailing group has been created in the 'Home/Business Relations' section, the tool allows sending alerts to a specific group. To do this, the desired company must be selected (it must be created in the 'Home/Business Relations' section), and it must be determined whether to alert a Contact or a Group. If a Group is selected, the tool offers the possibility to choose the group to notify about ticket changes.

• Occurrence Date: GlobalSUITE®® allows defining a date different from the registration date to evidence that the Incident or Problem occurred at a time prior to registration.

• Event Entry: Allows determining and recording how the event in question was communicated. This point does not appear automatically, but it is possible to configure it to be part of the record through the tool's settings.

In addition to the information to be recorded, the solution also allows:

• Affected Areas: Allows determining which areas of the company have been affected by the incident or problem that has arisen.

• Category: Allows determining the type of incident or problem that has occurred.

• Subcategory: Allows assigning a higher level of detail to the type of incident or problem determined.

This point does not appear automatically, but it is possible to configure it to be part of the record through the tool's settings.

• Category Help: Automatically defines, based on the configuration definition, the cause or vulnerability that caused the incident or problem.

• Event Agent: Allows indicating which agent detected the event being addressed.

• Detected By: Allows designating the person responsible for communicating or detecting the event.

• Affected Element: Allows specifying textually the elements affected by the incident.

• Recommendations: Allows establishing the recommendations deemed appropriate to help resolve the incident or problem.

• References: This field allows associating a specific URL linked to a name, which can be used for a correct or complete definition of the event.

• Impact: Allows establishing a qualitative value to determine the level of damage caused by the Incident or Problem.

• Urgency: Allows establishing a qualitative value to determine the speed with which the event must be resolved.

• Priority: This value is automatically generated by GlobalSUITE®®, calculating the arithmetic mean of the values established in the impact and urgency fields.

• Risks: This field allows defining which risks are associated with the occurrence of the specific incident or problem.

Employees

• Employees: Allows defining the employees who will handle the treatment of incidents and problems. These employees must be defined in the employee management option.

Evidence

• Evidence: To define as completely as possible, the solution allows attaching any type of file. If such documentation is not attached, it is also possible to provide a description in the Evidence field.

Crisis Management Plan Activation

This section allows identifying (and activating if desired) the Crisis Management Plans whose activation criteria are found in the ticket being addressed.

At the top, the Crisis Management Plans that meet the activation criteria (if any) are displayed. At the bottom, it is possible to select the associated dimensions and levels to qualify the impact of the incident. The list of dimensions and levels displayed corresponds to the configuration made in the "Business Continuity" option in the 'Settings' section.

If you wish to activate any of the identified Crisis Management Plans, you must select the corresponding plan and click the "Activate" button. This action notifies all members of the Committee responsible for the activated Crisis Management Plan.

Monitoring

This section begins the follow-up stage, where the guidelines and actions established to resolve the occurred event are defined.

• Response Time: Allows establishing the time taken to act to resolve the event.

• Measures: The actions necessary to begin resolving the incident or problem are established.

• Restored Data: Allows determining the data that needed to be recovered to resolve the incident or problem that occurred.

• Procedures: Allows establishing which procedures or instructions were necessary, determined, or helped resolve the event.

• Escalations: Allows recording whether it was necessary to escalate the incident or problem to another department or responsible party.

• Follow-ups: Within this option, any modification or change made to the event in question can be identified.

Any follow-up recorded can be sent via email to all those considered necessary to inform. As indicated, it is necessary to specify the email addresses and use the Send Email option.

On the other hand, if it has been generated from the client portal, it will be informed through this medium, selecting in the corresponding follow-up from the Portal column. Once saved, it will generate the notification automatically.

Configuration

• Configuration Elements: Allows determining which configuration elements have been affected by the incident or problem. Through this configuration field, the defined incident or problem can be automatically associated with specific configuration elements.

Risks

It offers the possibility to view the elements affected by the event and values defined in the risk analysis. The tasks that can be performed in this section are:

• Elements: Allows selecting the element(s) affected by the event.

• Analysis: Allows selecting the risk analysis(es) where the selected element is evaluated.

NOTE: The same element can be evaluated in different risk analyses with different evaluations, hence the need to indicate the risk analysis to be loaded.

• Add Element: Once the element is selected, it allows inserting it into the table.

• Delete Element: Allows deleting one or more elements from the table. To do this, the desired row must be selected and the 'Delete Element' button clicked.

Once the desired element row is selected, the table at the bottom allows the user to view or modify the values defined in the 'Analysis/Risk Analysis' section. The tool highlights in red those evaluations that have been modified.

NOTE: The tool allows simulating how the incident affects the elements evaluated in the 'Risk Management/Projection and Simulation' section. Depending on the methodology defined in the 'Settings/Analysis Methodology' section, the dimension evaluations can be qualitative or quantitative.

The actions that can be performed on the table are:

• Restore Threats: Allows restoring the initial values of the table according to the Risk Analysis performed.

Closure

Once the event has been resolved, GlobalSUITE®® allows defining how it was addressed.

• Resolution: To indicate the way in which it was addressed and allowed closing the service request.

• Resolution Time: Corresponds to the time spent resolving the event.

• Closure Date: Allows indicating the exact date and time when the incident or problem was closed.

Inputs and Outputs

The resolution considers the option that the incident or problem derives from a different event, or conversely, that it may have been generated by it. For these specific cases, the following options are presented:

• Inputs: Allows determining if the defined incident or problem originates from another type of event, providing the tool with the following options:

  • Corrective action.

  • Preventive action.

  • Non-conformity.

  • Change.

  • Service Request.

  • Incident.

  • Problem.

  • Event.

  • False positive.

• Outputs: Allows determining if the defined incident or problem results in another type of event, providing the tool with the options previously mentioned for inputs.

NOTE: Under the example established in the image, the incident or problem has generated the opening of a corrective action, which is automatically generated within the Management tab, in the Corrective and Preventive Actions option.

For both inputs and outputs, a series of common options are identified:

• Add: By selecting the type of event it originates from or results in, it will be included in the corresponding field, generating said event in another option provided by GlobalSUITE®, except for the cases of Event and False Positive.

• Delete: Deletes any event that has been added.

• Associate Existing: If the event it derives from was created previously, this option allows searching for that event so it can be associated with the corresponding service request.