You can create custom incident status and resolutions that are that are tailored to your workflow.
Warning
Before you create a custom status, please review the built-in options. For more information, see Resolution reasons for incidents and alerts.
We recommend using the built-in statuses and resolution reasons where possible. Custom statuses and resolution reasons might not be supported by all content, and status syncing can take time.
In addition, custom statuses affect Cortex XSIAM’s ability to learn, correctly identify, and score future incidents.
You can create custom incident statuses and custom resolution reasons that are tailored to your workflow. Custom incident statuses and resolution reasons apply to incident and alert statuses, and can also be used in playbooks.
Adding custom incident statuses and resolution reasons requires a View/Edit RBAC permission for Incident Properties (under Object Setup).
Go to → → → .
The existing statuses and resolution types are listed.
In the Add another status field, type a new status and click Save.
Click Edit to rearrange the order of the statuses. This order is presented when you set a status or select a resolution type.