Cisco Cisco FirePOWER Appliance 8390
19-6
FireSIGHT System User Guide
Chapter 19 Handling Incidents
Generating Incident Reports
To edit an incident:
Access:
Admin/Intrusion Admin
Step 1
Select
Analysis > Intrusions > Incidents
.
The Incidents page appears.
Step 2
Click the edit icon (
) next to the incident you want to edit.
Step 3
You can edit any of the following aspects of the incident:
•
change the status
•
change the type
•
add events from the clipboard
•
delete events
Step 4
In the
Time Spent
field, enter the amount of additional time you spent on the incident.
Step 5
In the
Add Comment
text box, indicate your changes to the incident (up to 8191 alphanumeric characters,
spaces and symbols) for the incident.
Step 6
Optionally, you can add or delete events from the incident:
•
To add events from the clipboard, select the events on the clipboard and click
Add to Incident
.
•
To add all the events from the clipboard, click
Add All to Incident
.
•
To delete specific events from the incident, select the events and click
Delete
.
•
To delete all events from the incident, click
Delete All
.
•
To update the incident without adding or deleting events, click
Save
.
Your changes to the incident are saved.
Generating Incident Reports
License:
Protection
You can use the FireSIGHT System to generate incident reports that can include the incident summary,
incident status, and any comments along with information from the events you add to the incident. You
can also specify whether you want to include event summary information in the report.
incident status, and any comments along with information from the events you add to the incident. You
can also specify whether you want to include event summary information in the report.
To generate an incident report:
Access:
Admin/Intrusion Admin
Step 1
Select
Analysis > Intrusions > Incidents
.
The Incidents page appears.
Step 2
Click the edit icon (
) next to the incident you want to include in your report.
Step 3
You have two options:
•
To include all the events from the incident in the report, click
Generate Report All
.
•
To include specific events from the incident in the report, select the check boxes next to the events
you want and click
you want and click
Generate Report
.