War Room lives in PSA, in progress — War Room is PSA's incident command center (app.theonestack.com/psa/war-room). It was previously documented under CyberAssure. It is still being built, so some actions may not be available yet.
The War Room is PSA's incident command center for outages, IT incidents and cyber response. It's where your team runs a major incident from start to finish: who's responding, what's affected, what was decided, and what you tell the client.
Open the War Room
Go to PSA → War Room (app.theonestack.com/psa/war-room). The list shows active incidents, with metrics such as mean time to contain and mean time to resolve. Click an incident to open it, or click Open Incident to start one (see Open an incident in the War Room).
Other apps can send you here. An RMM alert, a Defend alert or an On-Call incident can link straight into a new War Room incident with the details filled in.
Layout
- Header: incident title, severity, status, linked PSA ticket, and whether legal counsel is engaged.
- Left: affected assets and responders.
- Center tabs: timeline, THEO, playbook, comms and evidence.
- Right: THEO copilot and side panels, including legal and evidence chain.
- Action bar: the main response actions.
Response actions
- Contain all: isolates affected devices through RMM and queues evidence snapshots, after you confirm.
- Isolate infected: network-isolates the affected devices through RMM.
- Snapshot evidence: queues a forensic snapshot on each affected device before remediation, so evidence isn't lost.
- PSA ticket: link or open a PSA ticket for the incident.
- Video: opens the incident video bridge in a new tab, so the War Room stays open in the tab you're in.
- Page on-call: pages your on-call responders.
- Generate PIR: drafts a post-incident report, which you review.
Containment and isolation need the right PSA permission. If an action fails with a permission message, ask a PSA admin.
Status
Set the incident status from the header: Active, Contained, Resolving, Resolved or Post Mortem.
Legal counsel
For incidents that may become a legal matter, use the counsel panel to engage the partner attorney through the Legal app, or invite your own attorney into the external room.
THEO
THEO can draft updates and reports for the incident. Review every draft before you send it. THEO writes the first version, and you approve it.
FAQ
Is this the same as an On-Call incident?
No. On-Call incidents are pages and alerts. War Room incidents are major incidents you run as a team. You can page on-call from a War Room incident.
Is War Room part of CyberAssure?
No. War Room lives in PSA. CyberAssure covers client compliance and risk.