Tasks List View

After investigating incidents, in the Tasks List view (Respond > Tasks), you can create and track incident tasks. For example, you can create remediation tasks when you require actions on incidents from teams outside of your security operations. You can reference external ticket numbers within the tasks and then track those tasks to completion. You can also modify and delete tasks as required, depending on your user permissions.

What do you want to do?What do you want to do?

Role I want to ... Show me how

Incident Responders, Analysts

View tasks

View All Incident Tasks and View the Tasks Associated with an Incident

Incident Responders, Analysts Filter tasks.

Filter the Tasks List

Incident Responders, Analysts Create a task. Create a Task
Incident Responders, Analysts Find and modify tasks. Find a Task and Modify a Task
Incident Responders, Analysts Close a task (Change the Status to Remediated, Risk Accepted, or Not Applicable). Modify a Task
Incident Responders, Analysts, SOC Managers Delete a task. Delete a Task

Related TopicsRelated Topics

Quick Look Quick Look

To access the Tasks List view, go to Respond > Tasks. The Tasks List view displays a list of all incident tasks.

netwitness_12.1_taskslistvw2_1122.png

The Tasks List view consists of a Filters panel, a Tasks List, and a Task Overview panel. The following figure shows the Tasks List and the Overview panel.

netwitness_12.1_taskslistovervw_1122.png

Tasks ListTasks List

The Tasks List shows all of the incident tasks. You can filter this list to show only tasks of interest.

Column

Description

netwitness_ic-checkbox2_30x30.png Enables you to select one or more tasks to modify or delete. Users with the appropriate permissions can make bulk updates and delete tasks, such as SOC Managers. For example, an SOC Manager may want to assign multiple tasks to a user at the same time.
Created Displays the date when the task was created.
Priority Displays the priority assigned to the task. The priority can be any of the following: Critical, High, Medium, or Low. The Priority is also color coded, where red indicates Critical, orange represents High risk, yellow indicates Medium risk, and green represents Low risk as shown in the following figure:
netwitness_prioritylevels.png
ID Displays the task ID.
Name Displays the task name.
Assignee Displays the name of the user assigned to the task.
Status Displays the status of the task: New, Assigned, In Progress, Remediated, Risk Accepted, and Not Applicable.
Last Updated Displays the date and time when the task was last updated.
Created By Displays the user who created the task.
Incident ID Displays the incident ID for which the task was created. Click the ID to display the details of the incident.

At the bottom of the list, you can see the number of tasks on the current page and the total number of tasks. For example: Showing 23 out of 23 items

Task Filters PanelTask Filters Panel

The following figure shows the filters available in the Filters panel.

netwitness_tasksfilterspnl_240x514.png

The Filters panel, on the left of the Tasks List view, has options that you can use to filter the incident tasks.

Option Description
Time Range You can select a specific time period from the Time Range drop-down list. The time range is based on the creation date of the tasks. For example, if you select Last Hour, you can see tasks that were created within the last 60 minutes.
Custom Date Range You can specify a specific date range instead of selecting a Time Range option. To do this, click the white circle in front of Custom Date Range to view the Start Date and End Date fields. Select the dates and times from the calendar.
netwitness_custdaterange_240x300.png
Task ID You can type the Task ID for a task that you would like to locate, for example REM-123.
Priority You can select the priorities that you would like to view. If you make one or more selections, the Tasks list shows only those tasks​ with the selected priorities.
For example: If you select Critical, the Tasks list shows only the tasks​ with a priority set to Critical.
Status You can select the statuses that you would like to view. If you make one or more selections, the Tasks list shows only those tasks​ with the selected statuses.
For example: If you select Assigned, the Tasks panel shows only the tasks that are assigned to users.
Created By You can select the user who created the tasks that you would like to view. For example, if you only want to view the tasks created by Edwardo, select Edwardo from the CREATED BY drop-down list. If you want to view tasks regardless of the person who created the task, do not make a selection under CREATED BY.
Reset Filters Removes your filter selections.

The Tasks List shows a list of tasks that meet your selection criteria. You can see the number of items in your filtered list at the bottom of the tasks list. For example: Showing 18 out of 18 items

Task Overview PanelTask Overview Panel

To access the Task Overview panel:

  1. Go to Respond > Tasks.

  2. In the Task list, click the task that you want to view.
    The Task Overview panel appears to the right of the Tasks list.
    netwitness_tasksovervwpnl_240x339.png

The following table lists the fields displayed in the Task Overview panel.

Field

Description

<Task ID> Displays the automatically assigned task ID.
<Task Name> Displays the task name. This is an editable field. To change the task name, you can click the current task name to open a text editor. For example, you can change a task name from "Reimage a Laptop" to "Reimage a Server".
Incident ID Displays the Incident ID for which the task was created. Click the ID to display the details of the Incident.
Created Displays details about the date and time when the task was created.
Last Updated Displays the date and time when the task was last updated.
Priority Displays the priority of the task: Low, Medium, High, or Critical. To change the priority, you can click the priority button and select a priority for the task from the drop-down list.
Status Displays the status of the task: New, Assigned, In Progress, Remediated, Risk Accepted, and Not Applicable. To change the status, you can click the status button and select a status for the task from the drop-down list.
Assignee Displays the user assigned to the task. To change the user assigned to the task, you can click (Unassigned) or the name of the previous assignee to open a text editor.
Description Shows task details. To modify the description, you can click the text underneath the description to open a text editor.

Toolbar ActionsToolbar Actions

This table lists the toolbar actions available in the Tasks List view.

Option Description
netwitness_ic-filterclosed2.png

Enables you to open the Filters panel so that you can specify the tasks that you would like to see in the Tasks List.

netwitness_ic-x-close2.png

Closes the panel.

Delete button Allows you to delete the selected tasks.