Prismara SOCHow-to guide
Review and respond to incidents
When SovSec analysts find something that needs your attention, they raise an incident in Prismara SOC. This article shows you how to work through one.
Before you begin
Section titled “Before you begin”- You need access to Prismara SOC with a role that can comment on incidents. The read-only viewer role can read incidents but not reply or close them.
Open an incident
Section titled “Open an incident”-
In Prismara SOC, select Incidents.
-
Filter the list if you need to. Select Status > Awaiting your action to see incidents where the SOC is waiting for you.
Screenshot pendingThe Incidents list with the Status filter open and Awaiting your action selected -
Select the incident title to open it.
Read severity and status
Section titled “Read severity and status”The incident header shows two badges.
| Severity | What it means |
|---|---|
| High | Likely active threat. Act on the recommended actions as soon as possible. |
| Medium | Suspicious activity that needs checking soon. |
| Low | Unlikely to be harmful, but worth confirming. |
| Informational | For your awareness. No action usually needed. |
| Status | What it means |
|---|---|
| New | Raised by the SOC, not yet picked up. |
| In progress | A SovSec analyst is working on it. |
| Awaiting your action | The SOC needs you to do something or answer a question. |
| Resolved | Work is finished. You can reopen it within the close-out period. |
Follow the recommended actions
Section titled “Follow the recommended actions”-
On the incident page, open the Recommended actions tab. Each action describes what to do and where, for example resetting a user’s password in Microsoft Entra.
Screenshot pendingThe Recommended actions tab of an example incident with checkboxes for each action -
Carry out each action in the relevant Microsoft tool.
-
Select Mark as done next to each action you complete.
Comment or ask the SOC
Section titled “Comment or ask the SOC”-
Open the Conversation tab.
-
Type your question or update in the comment box. For example, confirm whether the activity was expected.
-
Select Send. The assigned analyst is notified, and you receive an email when they reply.
Screenshot pendingThe Conversation tab with a comment typed in the box and the Send button
Close out
Section titled “Close out”When all actions are done, the analyst sets the incident to Resolved and adds a summary. If you think the incident is finished first, add a comment saying so and the analyst will close it. If the problem comes back, select Reopen on the resolved incident.