Managing incident workflow

1. Click this button to manage the workflow of the selected incident, then select one of the following:
   • Assign - Select this option to assign the incident to someone or mark it as unassigned.
   • Change Status - Select this option to change the incident status.
   • Change Severity - Select this option to change the incident severity assignment.
   • Ignore Incident - Select this option to mark an incident as ignored or unmark and ignored incident. Mark an incident as ignored when you’ve reviewed it and no action is required.
   • Tag Incident - Select this option to associate an incident with a custom tag that you can later use in filters.
   • Add Comments - Select this option to comment on the incident. Comments are added to the incident history.
   • Delete - Select this option to delete selected incidents (all types), all incidents in the current report (network, endpoint, and mobile DLP incidents only), or all incidents at once (mobile DLP and discovery only).

The following option is available only for data loss prevention and mobile incidents:

• Download Incident - Select this option to download a data loss prevention incident.

The following options are available only for discovery incidents:

• Lock - Select this option to lock an incident, preventing the addition of any information from subsequent scans.
• Unlock - Select this option to unlock a locked incident.