Skip to content

Incident Log

The Incident Log centralizes security incidents created directly or promoted from tickets, Radar, or Signals.

Dashboard and filtering

Use dashboard metrics and charts to understand incident volume, severity, type, and site. Filter the log by status, severity, and other available attributes to focus on active work.

Investigate and document

  • Open the incident and review the originating description.
  • Assign the incident to a responsible technician and set status and severity.
  • Run IP lookup when the description contains public IP addresses.
  • Add investigation details, global notes, screenshots, files, and links.
  • Link related tickets and affected assets so each record exposes the relationship.
  • Use an applicable response playbook. Mark each step complete, save notes, and attach evidence at the relevant step.
  • Use Brief Me for a current narrative and risk summary. Export a detailed or executive PDF report for communication and records.
  • Record PII involvement, reportable-breach determination, notification deadline, and whether a vendor is leading the investigation.
  • Move the incident through open, in progress, resolved, and closed states; archive it when complete.

Compromised Microsoft 365 account playbook

The playlist demonstrates a ten-step playbook that includes disabling the account, signing out active sessions, changing the password, auditing MFA methods and app registrations, revoking tokens where appropriate, reviewing mailbox access and rules, inspecting mail folders, and auditing sign-in logs. The exact response should follow district policy and current Microsoft guidance.

Reportable breaches and calendar dates

When an incident is marked as a reportable breach, SupportStudioK12 calculates a due date from the reporting timeline configured for the district and places the notification deadline on the calendar. Confirm the actual legal requirement for the applicable jurisdiction and incident.

Vendor-managed incidents

Mark an incident vendor-managed when a third party is conducting most of the investigation. Continue adding vendor communications and status updates so district leadership can receive a current report from one place.

Access control: The videos describe incident access for administrators and security technicians. Because incident records may contain sensitive information, use the least-privilege role appropriate to district responsibilities.

Video 11: Incidents and IRP/DRP — Watch on YouTube