Configuring an Incident Type: General Configuration

Last Updated: October 23, 2026

Overview

The General tab of an incident type holds its basic settings: its name and description, the dispositions it offers, and the playbook that is preselected for each site.

To open it, go to Configuration > Incident Type Manager and select the incident type. The incident type opens on the General tab. See Incident Type Manager.

The General tab

The tab has two sections:

• General Configuration: the Incident Type Name and the Description.

• Defaults: Default Dispositions and Default Playbook. Each one is a panel that you can collapse and expand.

General Configuration

1. Change the Incident Type Name or enter a Description. Cancel and Save appear under the section as soon as a field changes.

2. Select Save.

Saving a description

Select Cancel instead to discard the change.

Default Dispositions

A disposition is the final outcome of an incident, such as True Positive or False Positive. The Default Dispositions panel lists the dispositions the incident type offers, in the order they are shown. A new incident type offers the six system dispositions, each marked SYSTEM:

• Resolved

• False Positive

• No Action

• Duplicate

• N/A

• True Positive

The Default Dispositions panel

Choosing the Dispositions

1. Select Edit Dispositions. The Default Dispositions window lists every disposition, and ticks the ones this incident type offers.

The Default Dispositions window

2. Tick the dispositions the incident type should offer, and clear the ones it should not. To find a disposition, type in Search for disposition.

3. Select Apply.

Choosing a disposition

Creating a Disposition

1. In the Default Dispositions window, select the + button beside the search box.

2. In Enter a name for the disposition, enter the name, then select the check mark button. Select the × button instead to cancel.

Naming a new disposition

3. Tick the new disposition, then select Apply.

Changing the Order

To change the order of the dispositions, drag a disposition by its handle (the dotted icon on its left) to a new place in the Default Dispositions panel. The new order is kept when you leave the tab.

Dragging a disposition

Default Playbook

The Default Playbook panel assigns an investigation playbook to sites for this incident type. The panel describes it this way: "When an incident is created with a matching site and type, the designated playbook will be preselected." The table under Assigned Sites and Playbooks lists each site with its Default Playbook, under Internal Sites and Client Sites.

The Default Playbook panel

Assigning a Default Playbook

1. Select Site & Playbooks.

2. In the Select Playbook window, select the playbook, then select Next. To find a playbook, type in Search for a playbook.

Selecting the playbook

3. In the Select Sites window, tick the sites under Available Sites, then select the right arrow button to move them to Assigned Sites. Select Save.

Selecting the sites

An assigned default playbook

Removing a Default Playbook

1. Select the × button at the end of the row in the Assigned Sites and Playbooks table.

2. In the confirmation, select Delete.

The removal confirmation