Symantec 10268947 User Guide - Page 95

Incidents and Events 95 About incidents and events To view incident data ◆ In the Network Security console, click the Incidents tab. All users can modify the view by adjusting font size, selecting and sorting columns, and/or applying filters. Viewing priority color codes All users can sort the incident data by clicking on the column heading. The toggle sorts the column in ascending or descending order. To sort the incidents ◆ Do one of the following: ■ Click the heading of the column you want to sort. ■ Click the column heading again to reverse the order. Annotating incidents and events You can add comments to incidents and events. Each annotation receives a time stamp and lists the author of the annotation. You can sort multiple annotations for an event by time stamp in ascending or descending order. To annotate an incident or event 1 On the Incidents tab, double-click an incident or event. 2 Click Analyst Note. 3 Enter the information relevant to this incident. The Note field can include guidelines established by the SuperUser, such as ticket number, owner, and the last action taken in response to the event. 4 Click Add Note to preserve your annotation. 5 In Analyst Note, click Close to save and close. Marking incidents as viewed All users can mark incidents to distinguish new incidents from reviewed incidents. To mark incidents already viewed 1 On the Incidents tab, right-click an incident. 2 In the pop-up list, click Mark Incident. The Marked column of the incident displays a red hash mark to indicate that it has been viewed.