Managing Incident Types

Scenario

This section describes how to manage incident types. The detailed operations are as follows:

• Viewing Incident Types: describes how to view existing incident types and their details.
• Adding an Incident Type: describes how to create custom incident types.
• Associating an Incident Type with a Layout: describes how to associate a custom incident type with an existing incident type.
• Editing an Incident Type: describes how to edit a custom incident type.
• Managing Existing Incident Types: describes how to enable, disable, and delete a custom incident type.

Limitations and Constraints

• By default, built-in incident types are associated with existing layouts. You cannot customize associated layouts.
• Built-in incident types are enabled by default and cannot be edited, enabled, disabled, or deleted.
• After a customized incident type is added, the Type Name, Type ID, and Subtype ID parameters cannot be modified.

Viewing Incident Types

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
4. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

5. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 2 Type Management page
   

6. On the Type Management page, click the Event Types tab.
7. On the Event Types tab, view the details about existing incident types. For details about the parameters, see Table 1.

   Table 1 Incident type parameters

   Parameter	Description
   Type Name	Name of an incident type
   Sub Type/Sub Type Tag	Name and ID of an incident subtype
   Associated Layout	Layout associated with the incident type
   Startup Status	Indicates whether an incident type is enabled. Enable: The current type has been enabled. Disabled: The current type has been disabled.
   SLA	SLA processing time of an incident type
   Description	Description of an incident type
   Operation	You can edit and delete incident types.

Adding an Incident Type

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
4. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 3 Workspace management page
   

5. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 4 Type Management page
   

6. On the Type Management page, click the Event Types tab.
7. On the Event Types tab, click Add. On the Add Event Type slide-out panel, set incident type parameters.

   Table 2 Incident type parameters

   Parameter	Description
   Type Name	Customized name of an incident type.
   Type Tag	Enter the incident type ID. The keyword must comply with the upper camel case naming rules, for example, TypeTag.
   Sub Type	Enter the subtype of the incident type.
   Sub Type Tag	Enter the incident subtype ID. The keyword must comply with the upper camel case naming rules, for example, SubTypeName.
   Startup Status	Indicates whether an incident type is enabled.
   SLA	Set the SLA processing time of the incident.
   Description	Description of a custom incident type

   

   After a customized incident type is added, the Type Name, Type ID, and Subtype ID parameters cannot be modified.

8. In the lower right corner of the page, click OK.

   After the incident type is added, you can view the new incident type in Type Name on the Event Type page.

Associating an Incident Type with a Layout

By default, built-in incident types are associated with existing layouts. You cannot customize associated layouts.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
4. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 5 Workspace management page
   

5. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 6 Type Management page
   

6. On the Type Management page, click the Event Types tab.
7. On the Event Type page, select the incident type to be associated with a layout and click Associated Layout in the Operation column of the target type.
8. In the Associate Layout dialog box, select the target layout and click OK.

Editing an Incident Type

• Currently, the built-in incident type cannot be edited.
• After a customized incident type is added, the Type Name, Type ID, and Subtype ID parameters cannot be modified.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
4. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 7 Workspace management page
   

5. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 8 Type Management page
   

6. On the Type Management page, click the Event Types tab.
7. In Type Name on the Alarm Types page, click the name of the customized incident type to be edited. Details about the custom incident type are displayed on the right.
8. On the Event Type page, click Edit in the Operation column of the target type to be edited.
9. In the Edit Event Type dialog box, edit parameters.

   Table 3 Incident type parameters

   Parameter	Description
   Type Name	Name of an incident type, which cannot be modified.
   Type Tag	Incident type ID, which cannot be modified.
   Sub Type	Enter the subtype of the incident type.
   Sub Type Tag	Incident subtype ID, which cannot be modified.
   Startup Status	Indicates whether an incident type is enabled.
   SLA	Set the SLA processing time of the incident.
   Description	Description of a custom incident type

10. In the lower right corner of the page, click OK.

Managing Existing Incident Types

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
4. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 9 Workspace management page
   

5. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 10 Type Management page
   

6. On the Type Management page, click the Event Types tab.
7. On the incident type tab, manage incident types.
   

   • The built-in incident types are enabled by default. You do not need to manually enable them.
   • Currently, built-in incident (event) types cannot be disabled or deleted.

   Table 4 Managing existing incident types

   Operation	Description
   Enable	On the type management page, select the type to be enabled and click Batch Enable. Alternatively, locate the row containing the incident type to be enabled, click Disable in the Status column. In the dialog box displayed, click OK. If the system displays a message indicating that the operation is successful and the status of the target type changes to Enable, the target type is enabled successfully.
   Disable	On the Event Type page, select the type to be disabled and click Batch Disable. Alternatively, locate the row containing the incident type to be disabled, click Enable in the Status column. In the dialog box displayed, click OK. If the system displays a message indicating that the operation is successful and the Status of the target type changes to Disable, the target type is disabled successfully.
   Delete	On the incident type management page, select the type to be deleted and click Delete in the Operation column. In the displayed dialog box, click OK.