Define incident response roles

Incident Response Roles help teams to provide visibility of the responsible users during an incident response process. Define the roles to use during their incident response processes and make assignments to these roles differently, per incident.

How to configure available Incident Response Roles

From the Settings page, navigate to the Incident Configurations page, and add a new role from the 'Add an Incident Response Role’ button in the Incident Response Roles section.

Within the 'Add Incident Response Role' window, define the name and the description of the role and designate the option to show this specific role within a created incident by default.

There are 4 roles created by default for each team which can be removed if desired:

1- Incident Commander: Responsible for managing the incident response process and providing direction to the responder teams.

2- Communications Officer: Responsible for handling communications with the stakeholders and responders.
3- Scribe: Responsible for documenting the information related to incident and its response process.

4- SME (Subject Matter Expert): Technical domain experts who support the incident commander in incident resolution.

How to define user(s) to available Incident Response Roles

Make the assignments for each incident response role for each incident separately. Depending on the available incident response in your account, the members of the owner team of the incident can assign the necessary roles to the related user(s).

The incident response roles that are selected to be shown by default will always be visible in the incident’s details and its ICC sessions for the owner team to assign/fill in. The rest of the roles can be selected and assigned to user(s) by clicking to the + Assign a new role button.

Make assignments from two places:

1- From the incident details view:

Incident response roles for a specific incident are defined from the Incident Details page. Simply click on the incident to open its details and navigate to the Responders section. Assign users to default roles and update assignments from the available roles defined for the owner team of the incident.

2- From the ongoing ICC session:

The alternate way to define incident response roles for a specific incident is from an ongoing ICC session. Click ‘Assign/Update Roles’ on the right-hand side of the ICC window. Assign users to the default roles, update the assignments, and/or add new roles and their assignments from the available roles defined for the owner team of the incident.