Managing Incident Types

Limitations and Constraints

• By default, built-in incident types are associated with existing layouts. You cannot customize associated layouts.
• Built-in incident types are enabled by default and cannot be edited, enabled, disabled, or deleted.
• After a customized incident type is added, the Type Name, Type ID, and Subtype ID parameters cannot be modified.

Viewing Incident Types

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security > SecMaster.
3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Management
   

4. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 2 Type Management page
   

5. On the Types page, click the Event Type tab. The Event Type page is displayed.
6. On the Event Type page, view the details about existing incident types. For details about the parameters, see Table 1.
   Figure 3 Viewing incident types
   

   Table 1 Incident type parameters

   Parameter	Description
   Type Name	Name of an incident type
   Sub Type/Sub Type Tag	Name and ID of an incident subtype
   Associated Layout	Layout associated with the incident type
   Startup Status	Indicates whether an incident type is enabled. Enable: The current type has been enabled. Disabled: The current type has been disabled.
   SLA	SLA processing time of an incident type
   Description	Description of an incident type
   Operation	You can edit and delete incident types.

Adding an Incident Type

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security > SecMaster.
3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 4 Management
   

4. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 5 Type Management page
   

5. On the Types page, click the Event Type tab. The Event Type page is displayed.
6. On the Event Type page, click Add. On the Add Event Type slide-out panel, set incident type parameters.

   Table 2 Incident type parameters

   Parameter	Description
   Type Name	Customized name of an incident type. The name must comply with the upper camel case naming rules, for example, TypeName.
   Type Tag	Enter the incident type ID. The keyword must comply with the upper camel case naming rules, for example, TypeTag.
   Sub Type	Enter the subtype of the incident type. The name must comply with the upper camel case naming rules, for example, SubType.
   Sub Type Tag	Enter the incident subtype ID. The keyword must comply with the upper camel case naming rules, for example, SubTypeName.
   Startup Status	Indicates whether an incident type is enabled. : indicates that the type is enabled. : indicates that the alert type is disabled.
   SLA	Set the SLA processing time of the incident.
   Description	Description of a custom incident type

   

   After a customized incident type is added, the Type Name, Type ID, and Subtype ID parameters cannot be modified.

7. In the lower right corner of the page, click OK.

   After the incident type is added, you can view the new incident type in Type Name on the Event Type page.

Associating an Incident Type with a Layout

By default, built-in incident types are associated with existing layouts. You cannot customize associated layouts.

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security > SecMaster.
3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 6 Management
   

4. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 7 Type Management page
   

5. On the Types page, click the Event Type tab. The Event Type page is displayed.
6. On the Event Type page, select the incident type to be associated with a layout and click Associated Layout in the Operation column of the target type.
7. In the Associate Layout dialog box, select the layout to be associated.
8. Click OK.

Editing an Incident Type

• Currently, the built-in incident type cannot be edited.
• After a customized incident type is added, the Type Name, Type ID, and Subtype ID parameters cannot be modified.

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security > SecMaster.
3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 8 Management
   

4. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 9 Type Management page
   

5. On the Types page, click the Event Type tab. The Event Type page is displayed.
6. In Type Name on the Alarm Types page, click the name of the customized incident type to be edited. Details about the custom incident type are displayed on the right.
7. On the Event Type page, click Edit in the Operation column of the target type to be edited.
8. In the Edit Event Type dialog box, edit parameters.

   Table 3 Incident type parameters

   Parameter	Description
   Type Name	Name of an incident type, which cannot be modified.
   Type Tag	Incident type ID, which cannot be modified.
   Sub Type	Enter the subtype of the incident type.
   Sub Type Tag	Incident subtype ID, which cannot be modified.
   Startup Status	Indicates whether an incident type is enabled. : indicates that the type is enabled. : indicates that the alert type is disabled.
   SLA	Set the SLA processing time of the incident.
   Description	Description of a custom incident type

9. In the lower right corner of the page, click OK.

Managing Existing Incident Types

1. Log in to the management console.
2. Click in the upper left corner of the page and choose Security > SecMaster.
3. In the navigation pane, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 10 Management
   

4. In the navigation pane on the left, choose Security Orchestration > Objects. On the displayed page, click the Type Management tab.
   Figure 11 Type Management page
   

5. On the Types page, click the Event Type tab. The Event Type page is displayed.
6. On the incident type tab, manage incident types.

   Table 4 Managing existing incident types

   Parameter	Description
   Enable NOTE: The built-in incident types are enabled by default. You do not need to manually enable them.	On the type management page, select the type to be enabled and click Batch Enable. Alternatively, locate the row containing the incident type to be enabled, click Disable in the Status column. In the dialog box displayed, click OK. If the system displays a message indicating that the operation is successful and the status of the target type changes to Enable, the target type is enabled successfully.
   Disable NOTE: Currently, the built-in incident types cannot be disabled.	On the Event Type page, select the type to be disabled and click Batch Disable. Alternatively, locate the row containing the incident type to be disabled, click Enable in the Status column. In the dialog box displayed, click OK. If the system displays a message indicating that the operation is successful and the Status of the target type changes to Disable, the target type is disabled successfully.
   Delete NOTE: Currently, built-in incident types cannot be deleted.	On the incident type management page, select the type to be deleted and click Delete in the Operation column. In the dialog box displayed, click OK.