War Room lives in PSA, in progress — War Room is PSA's incident command center (app.theonestack.com/psa/war-room). It was previously documented under CyberAssure. It is still being built, so some actions may not be available yet.
When a client has an outage, an IT incident or a security incident, open it in PSA's War Room to run a tracked response. This article covers the incident list and opening an incident.
The incident list
Go to PSA → War Room (app.theonestack.com/psa/war-room). Active incidents are listed with their severity and status. When nothing is active, the page says No active incidents.
Open an incident
- Click Open Incident.
- Enter a title, severity, type and description, and choose the client.
- Save. The incident opens in the War Room.
Severity runs from P0 (most severe) downward. Match it to business impact and urgency.
Links from RMM alerts, Defend and On-Call can open this form with the details already filled in.
Incident status
- Active: response underway.
- Contained: the threat or outage is held but not yet cleared.
- Resolving: cleanup in progress.
- Resolved: closed.
- Post Mortem: under review after the incident.
FAQ
Where did "Declare incident" in CyberAssure go?
Incident command lives in PSA's War Room. CyberAssure covers client compliance and risk.