• Products
  • Get started
  • Documentation
  • Resources

Define incident response roles

Incident Response Roles help teams to provide visibility of the responsible users during an incident response process. Define the roles to use during their incident response processes and make assignments to these roles differently, per incident.

Please note that the incident response roles are display-only, i.e., just for giving visibility to the responder teams during the incidents. Incident management/action rights are handled on user basis via custom roles. Please make sure the user(s) added to each incident response role have the necessary incident management rights to take action on the incidents.

How to configure available Incident Response Roles

From the Settings page, navigate to the Incident Configurations page, and add a new role from the 'Add an Incident Response Role’ button in the Incident Response Roles section.

Within the 'Add Incident Response Role' window, define the name and the description of the role and designate the option to show this specific role within a created incident by default.

There are 4 roles created by default for each team which can be removed if desired:

1- Incident Commander: Responsible for managing the incident response process and providing direction to the responder teams.

2- Communications Officer: Responsible for handling communications with the stakeholders and responders.
3- Scribe: Responsible for documenting the information related to incident and its response process.

4- SME (Subject Matter Expert): Technical domain experts who support the incident commander in incident resolution.

How to define user(s) to available Incident Response Roles

Make the assignments for each incident response role for each incident separately. Depending on the available incident response in your account, the members of the owner team of the incident can assign the necessary roles to the related user(s).

The incident response roles that are selected to be shown by default will always be visible in the incident’s details and its ICC sessions for the owner team to assign/fill in. The rest of the roles can be selected and assigned to user(s) by clicking to the + Assign a new role button.

If a user is assigned an incident response role and is not currently a part of incident responders, the user will be automatically added as the incident responder and receive an alert.

Make assignments from two places:

1- From the incident details view:

Incident response roles for a specific incident are defined from the Incident Details page. Simply click on the incident to open its details and navigate to the Responders section. Assign users to default roles and update assignments from the available roles defined for the owner team of the incident.

An image that shows where to assign role from incident detail.
An image that shows available incident role options.

2- From the ongoing ICC session:

The alternate way to define incident response roles for a specific incident is from an ongoing ICC session. Click ‘Assign/Update Roles’ on the right-hand side of the ICC window. Assign users to the default roles, update the assignments, and/or add new roles and their assignments from the available roles defined for the owner team of the incident.

An image that shows where to assign roles from ICC.

 

An image that shows how to add responders from ICC.

Additional Help