What are ISSUES?
An 'issue' is an observation or occurrence that a user would like to report using 'Report an Issue' in the Use Menu.
Most effective use of issues is to (1) set up initial response teams to monitor issues (2) insure all event classes and sites at the organization are covered by initial response teams. NOTE: if you do not set up initial response teams as recommended, issues will be listed in the 'Search Issues' report under the Track Menu, as open items.
Once an issue is reported to the initial response team leader, that team leader will have a choice of how to handle that issue. The use of issues adds a second layer of reporting of activity within the company, that does not necessarily require the automation of a process, but the gathering of information for use which might lead to use of a process in the future.
Report an Issue
Step 1: In the USE menu, select Report an Issue
Step 2: Complete the form. Name, detailed description, location and event category.
Ex: An open container of an unidentifiable substance has been found and reported.
Reminder: Initial response teams (IRT) are assigned responsibility for 'EVENT types' so this event selection will determine which team leader receives the notification. Similarly, initial response teams are tied to the 'SITE' location of each organizational unit. Hence, if you have multiple sites, you should create an IRT for each organizational unit.
The TEST toggle is available for selection if this function is being used as part of a test and the issue is to be flagged as such.
Step 3: Click SAVE and the invitation will be sent to the email and the work console of the team leader.
Receipt of notification of a reported issue
Team leaders of IRTs will receive notifications of reported issues in their email and work console:
***please note our terminology has changed from episode to event and we are currently updating our help docs.***
You have 3 options:
Add To Event - which means to assign this issue to a pre-exising event for tracking purposes
Create Event - if no event exists for which this issue should be assigned and it appears important enough to begin to track, create a new event and the issue will be assigned to it. From here, a process may be started associated with that event.
Close Issue - after assessing the situation, you decide to close it out.
Add To Event:
When you click the Add To Event option, a list of all events logged in strake/IR will appear. Find the event you want to add the issue to and submit the choice.
Create Event
If you choose Create Event, a form will appear to log a new event. Create the title and description, select the teams from the 'team detail' tab and save the event. Your issue will be attached to this new event for tracking purposes.
Search Event
When you search event under the TRACK menu, you can click on the event to review its details. Click on the Issue Details Tab to see the list of issues that have been logged with that event.
Close Issue
If you decide to close the issue, it will remain logged as a closed issue with all details available for review.
Select SEARCH ISSUES from the TRACK menu in order to review all issues.
Why use ISSUES?
strake/IR allows you to create a complex organization, which can include levels of response to incidents within your company. If you are using strake/IR for cyber security incident response support, you may choose to have an initial response team review all incoming reports of issues and require them to escalate those deemed necessary to events and initiate all response processes.
If you are using strake/IR to test incident response processes, you may choose to have issues logged while testing specific processes in order to establish a log of all of the issues encountered during testing for process improvement.
If you are using strake/IR for quality control purposes, you may choose to have users log all quality issues for a central review.
Let us know what use you find for Issues and we will add it here!
Comments