The War Room is CyberAssure's live incident-command workspace. It is where you run a breach response with your client: a recorded audio/video session on top of a decision log, a runbook to work through, THEO-drafted comms, and an evidence locker. This article covers the War Room layout and the core actions — logging decisions, using the runbook, publishing THEO drafts, capturing evidence, litigation hold, and resolving.
Opening the War Room
Declare an incident (see Declaring an Incident) or click Join War Room from any incident row. The first time you join a recorded session you are asked to confirm a Recording Consent notice — the session may be recorded and preserved as evidence for litigation purposes. Confirm to enter.
Layout
- Desktop — split view: audio/video on top, the decision log and tabs below.
- Mobile — stacked: video on top, tabs below.
The banner at the top shows the incident, its status, and the MSP-admin actions: Litigation Hold and Resolve.
Logging Decisions
The Decision Log is the authoritative record of what was decided and when.
- Click Log Decision.
- Enter the decision and any context.
- Submit.
Entries are timestamped and preserved. Long entries can be expanded with Show more. The decision log is part of the incident's evidentiary record.
Working the Runbook
The Runbook panel walks you through the response steps for the incident type. Work through it during the response so nothing is missed — the steps come from your runbook library (see Templates). Completing runbook steps keeps the response consistent across your team and clients.
THEO Drafts (AI-assisted comms)
The THEO Drafts panel generates communications for the incident — client updates, holding statements, and audio scripts. For each draft you can:
- Publish to Chat — push the text into the War Room chat for the client/team.
- Publish Audio Script — turn the draft into an audio script for the call.
- Discard — permanently delete a draft you do not want.
Review every draft before publishing — THEO writes the first version, you approve it.
Files & Evidence
The Files & Evidence panel is the evidence locker. Drop files (logs, screenshots, forensic artifacts) to attach them to the incident. Combined with the decision log, this builds the evidentiary record for the incident.
Litigation Hold
For incidents that may lead to legal proceedings, an MSP admin can click Litigation Hold in the banner. This preserves all recordings and logs for the session — nothing can be purged while the hold is in place. Use it whenever the incident could become a legal matter.
Resolving the Incident
When the response is complete, an MSP admin clicks Resolve in the banner and confirms. Resolving marks the incident resolved and closes the War Room. The decision log, evidence, and any recordings remain available for review.
FAQ
Is the session really recorded? It can be. You confirm a recording-consent notice on entry, and all communications in the War Room may be preserved as evidence. Use Litigation Hold to guarantee preservation.
Who can resolve or set litigation hold? Those banner actions are restricted to MSP admins.
What happens to my decision log and evidence after resolve? They are preserved. Resolving closes the active workspace but the record (decisions, files, recordings) stays attached to the incident.