Review and respond to incidents

When SovSec analysts find something that needs your attention, they raise an incident in Prismara SOC. This article shows you how to work through one.

• You need access to Prismara SOC with a role that can comment on incidents. The read-only viewer role can read incidents but not reply or close them.

1. In Prismara SOC, select Incidents.

2. Filter the list if you need to. Select Status > Awaiting your action to see incidents where the SOC is waiting for you.

   soc.prismara.eu

   Screenshot folgtThe Incidents list with the Status filter open and Awaiting your action selected

3. Select the incident title to open it.

The incident header shows two badges.

Severity	What it means
High	Likely active threat. Act on the recommended actions as soon as possible.
Medium	Suspicious activity that needs checking soon.
Low	Unlikely to be harmful, but worth confirming.
Informational	For your awareness. No action usually needed.

Status	What it means
New	Raised by the SOC, not yet picked up.
In progress	A SovSec analyst is working on it.
Awaiting your action	The SOC needs you to do something or answer a question.
Resolved	Work is finished. You can reopen it within the close-out period.

1. On the incident page, open the Recommended actions tab. Each action describes what to do and where, for example resetting a user’s password in Microsoft Entra.

   soc.prismara.eu

   Screenshot folgtThe Recommended actions tab of an example incident with checkboxes for each action

2. Carry out each action in the relevant Microsoft tool.

3. Select Mark as done next to each action you complete.

1. Open the Conversation tab.

2. Type your question or update in the comment box. For example, confirm whether the activity was expected.

3. Select Send. The assigned analyst is notified, and you receive an email when they reply.

   soc.prismara.eu

   Screenshot folgtThe Conversation tab with a comment typed in the box and the Send button

When all actions are done, the analyst sets the incident to Resolved and adds a summary. If you think the incident is finished first, add a comment saying so and the analyst will close it. If the problem comes back, select Reopen on the resolved incident.

• Get started with the Prismara SOC portal
• View and export reports
• Troubleshoot Prismara SOC