Setting Up a Custom Triage

LAST UPDATED: MARCH 13, 2025

The investigation dashboard organizes custom triages within the Events, Incidents, and Pending Tasks sections. A custom triage organizes and groups prioritized events, incidents, or pending tasks based on user-relevant characteristics. Once saved, users can quickly revisit these views.

Role Token Requirement for Custom Triages

The Enable Triage role token is required for a user to create and view custom triages.

Procedures

Creating a Simple Custom Triage

1. Drag the table's column headers into the Saved Searches field to define groupings.

   

2. Observe the number of groupings reflected in a hierarchical structure, aligned with the order in which the attributes are positioned within the Saved Searches field.

   

3. Click on the button next to the Incidents accordion.

   

4. Create the custom triage.

   

   1. Input a unique custom triage name.

   2. (Optional) Make this triage accessible for viewing by other users, groups, or roles.

   3. Click on the Create button.

5. Click the newly created the custom triage to view it.

   

RESULT

Users can now return to this custom triage from any other view.

Creating a Custom Triage with Predefined Sort Orders and Filters

Users can further customize their triages by sorting data in ascending or descending order by table headers and applying filters.

Sorting Using Table Headers

If users drag a header into the Saved Searches field while sorting is applied, a Column Sorting section will appear in the Edit Triage popup, reflecting the applied sorting in either ascending or descending order.

Ordering Headers in the Saved Searches Field

The order of headers in the Saved Searches field determines how incidents are grouped and sorted in the table.

• The leftmost header serves as the primary grouping.

• Each subsequent header to the right creates nested subgroups.

• The rightmost header defines the most specific sorting level within the final subgroup.

If a table header can contain repeatable values—such as Incident Type or Status—users can adjust how incidents within each group (accordion) are sorted by clicking the attribute in the Saved Searches field.

Applying a Filter

Users can click the button on any table header to apply filters and display data matching specific incident attributes. Multiple filters can be applied across one or more table headers.

Use Case: Creating a Triage Sorted by Incident No. and Filtered for Data Breach Incidents

Users can save a custom triage with a predefined table header sorting order and filters in the following steps:

1. Click an incident attribute in the table header to modify its sorting order (e.g., Incident No.).

   

   In this example, the Incident No. column is currently sorted in descending order, with numbers decreasing sequentially.

   

2. Drag the Incident No. column header, sorted in descending order, into the Saved Searches field.

   

3. Filter a column by a specified value.

   

   1. Click the button on the desired column header to apply a filter to it.

   2. Select a value to filter by.

   3. Click the Filter button.

4. Drag the filtered column header (e.g., Incident Type) into the Saved Searches field.

   

5. Click on the button next to the Incidents accordion to create a custom triage based on the current view.

   

6. Create the custom triage.

   

   1. Input a unique custom triage name.

   2. (Optional) Make this triage accessible for viewing by other users, groups, or roles.

   3. Review the triage conditions.

   4. Click on the Create button.

7. Click the newly created the custom triage to view it.

   

RESULT

The table data is sorted with Incident No. as the primary sorting reference in descending order and filtered to display only Data Breach incidents.

Managing Custom Triages

Reordering Custom Triages

Hover over a custom triage item, then drag the icon (grab handle) to adjust its order.

Editing and Deleting Custom Triages

To edit or delete a triage, click on the icon.

• Clicking on the Edit Triage option will reopen the Edit Triage popover.

• Clicking on the Remove Triage option will open a popover, prompting the user to confirm and delete the selected custom triage.

READER NOTE

• Only the owner can delete their custom triage – no one else has permission.

• If a user did not create the custom triage, only the View Triage option will be available.

  

• If the triage owner edits or deletes their custom triage, users with viewing access will receive a notification indicating the update. Clicking the Update button will either synchronize the viewer’s triage to the latest version (if edited) or remove it (if deleted).