When a client has a security incident, you declare it in CyberAssure to open a tracked response. Declaring an incident creates its War Room — the live workspace where you run the response. This article covers the Incidents list, declaring an incident at a severity, and joining the War Room.
The Incidents List
Go to Incidents (app.theonestack.com/cyberassure/incidents). Each incident row shows:
- Client — the affected managed organization.
- Severity — P0, P1, P2, or P3.
- Scope — the systems or area affected.
- Declared at — when the incident was opened (active incidents show elapsed time).
- Status — Declared, Active, Contained, or Resolved.
- Join War Room — opens the live response workspace.
Declaring an Incident
- On the Incidents page, click Declare Incident.
- Choose the Client affected.
- Choose the Severity:
| Severity | Use for |
|---|---|
| P0 | Critical — active breach, major business impact |
| P1 | High — significant impact, urgent response |
| P2 | Medium — contained or limited impact |
| P3 | Low — minor or suspected, low urgency |
- Describe the scope (what is affected) in the note.
- Click Declare.
The incident is created and you are taken straight into its War Room.
Joining a War Room
From any incident row, click Join War Room. A bare incident deep-link (/cyberassure/incidents/:id) automatically redirects to that incident's War Room workspace, so links from notifications or other products land in the right place.
Incident Lifecycle
- Declared → just opened.
- Active → response underway.
- Contained → the threat is held but not yet cleared.
- Resolved → closed from inside the War Room (see Running a War Room).
FAQ
What severity should I pick? Match it to business impact and urgency. P0 is reserved for active, high-impact breaches; P3 for minor or suspected issues. You declare at your best initial assessment and can run the response from there.
Does declaring an incident notify the client? The response happens in the War Room, which the client can join on a recorded call. Comms to the client are drafted and published from inside the War Room (THEO Drafts → Publish to Chat / Publish Audio Script).
Can I open the War Room for a resolved incident? Yes. A resolved incident row still links to its War Room so you can review the decision log and evidence.