Toolbar buttons

Click this button to manage the workflow of the selected incident, then select one of the following:

• Assign - Select this option to assign the incident to someone or mark it as unassigned.
• Lock - Select this option to lock the selected incident, preventing any further changes from future scans of the file. This option applies only to discovery incidents.
• Unlock - Select this option to unlock a locked incident, allowing information from future scans to overwrite the current data. This option applies only to discovery incidents.
• Change Status - Select this option to change the incident status or change the status labels.
• Change Severity - Select this option to change the incident severity assignment.
• Ignore Incident - Select this option to mark an incident as ignored or unmark an ignored incident. Mark an incident as ignored when you’ve reviewed it and no action is required.
• Tag Incident - Select this option to associate an incident with a custom tag that you can later use in filters.
• Add comments - Annotate the incident.
• Download Incident - Select this option to download an incident. This option applies only to data loss prevention incidents. You can download just one incident at a time. This option applies only to DLP and mobile incidents.
• Delete - Select this option if you want to delete incidents. Depending on the type of incident (network, endpoint, mobile, or discovery), you may be able to delete selected incidents, all incidents that match the filter criteria for the current report, or all incidents.

(See Managing incident workflow section for details on all of these options.)

Click this button to remediate the selected incident, then select one of the following:

• Release - Select this option to release the selected incidents (email messages) from quarantine. This option applies only to data loss prevention incidents on network, endpoint, and mobile email channels. You can add a comment to the confirmation window for future reference if desired. Not supported for messages detected by Forcepoint Email Security Cloud.
• Run Remediation Script - Select this option to run a remediation script on the selected incident.

(See Remediating incidents for details on both options.)

Click this button to eDescriptionscalate the selected incident to a manager or other person:

• Email to Manager - Select this option to email the incident to the manager of the person generated the policy breach.
• Email to Other - Select this option to email the incident to another person for action.

(See Escalating incidents for details on both options.)

Click this button to edit the filter or table properties applied to the current report, then select one of the following:

• Edit Filter - Select this option to edit the filters applied to the report—for example, choosing a longer time period or single channel.
• Table Properties - Select this option to customize the properties of the incident table.
• Save - Select this option to save the changes you made to current report.
• Save As - Select this option to save the current report with a new name.

(See Managing incident reports for details on all of these options.)

Lets you set preferences for incident lists and reports. For example, for data loss prevention incidents, you can define attachment size and forensics settings. For discovery incidents, you can set database thresholds. You can also define general settings, like filtering and printing, that apply to all types of incidents.

For information on configuring these settings, see

Setting reporting preferences.

Lets you customize the view in your incident list. You can choose any of the following:

• Incident list only - Removes the preview so that many more incidents can appear in the list.
• Incident preview only - Removes the list so you can preview more of the incident.
• Incident list and preview - Displays the incident list and the preview in the same window. Includes scroll bars on the incident list.
• Open preview in a new window - Opens a preview of the incident in a new window, so you can view it in its entirety.