Logsign Task Management
Purpose:
This document provides an overview and step-by-step instructions on how to use the Task feature on the incident detail page of Logsign. It aims to help security teams efficiently manage incident-related tasks, track progress, and ensure timely resolution of security incidents.
1. Introduction to Task Management in Incident Management
The Task feature on the incident detail page allows security teams to assign, track, and manage tasks related to security incidents. Each task is written for a specific incident, assigned to a user, and followed until it is marked as completed or as not possible to complete.
2. Accessing Task Management in Incident Management
Steps:
-
Login to Logsign:
-
Open your browser and log in to your Logsign dashboard.
-
-
Navigate to Incident Management:
-
In the top menu, select Incidents and open the incident you want to work on.
-
-
Open Task Management:
-
On the Timeline tab of the incident, click the Task card in the summary area. The card shows the number of completed tasks and the total number of tasks (for example, 1 / 3). Click the card again to collapse the task list.
-
3. Key Features of Task Management
3.1. Create a New Task
-
Navigate to the specific incident for which you want to create a task and open the Task card.
-
Click Add Task. This button is shown only while the incident status is Open.
-
Fill in the following details (both fields are required):
-
Task: Describe clearly what needs to be done.
-
Assignee: Select the user responsible for this task. If both local and LDAP/SSO users exist, the list is grouped by user source.
-
-
Once completed, click Save to create the task.
3.2. Task Assignment and Collaboration
-
Assign each task to an individual user within your security team. A task has a single assignee.
-
Tasks are linked directly to the incident, allowing for easy reference and follow-up. Next to each task, the avatars of the user who created it and the assignee are shown.
3.3. Monitor Task Progress
-
The task list shows all tasks of the incident with their order (for example, 2 / 5), their assignees and when they were created. You can change the order of the tasks by dragging them.
-
Each task includes a status label: Incomplete, Completed or Can't Complete.
3.4. Update or Edit Tasks
-
Click the menu icon (three dots) on the right of a task.
-
Select Completed, Incomplete or Can't Complete to change the task's status.
-
Select Edit to change the task description or the assignee, then click Save.
-
Select Delete and confirm to remove a task.
4. Best Practices for Using Task Management in Incident Response
4.1. Assign Clear Roles
-
Assign tasks to individuals who are best suited to handle them based on expertise.
4.2. Regularly Monitor Progress
-
Regularly check the task list to ensure that tasks are being completed as scheduled. Use the Incomplete label to see which tasks still need action, and the completed / total count on the Task card to follow overall progress.
4.3. Collaborate Efficiently
-
Encourage team collaboration by using the Comment card of the incident to share updates or feedback. Comments are kept at incident level, not per task.
5. Closing Tasks
Once a task is completed:
-
Change the task's status to Completed. If the task cannot be carried out, set it to Can't Complete.
-
Ensure that all details are documented in the task description or in the incident comments.
-
Tasks remain in the incident record with their final status for future reference, unless they are deleted.
6. Reporting and Analytics
-
Tasks are included in the incident report. On the incident page, click Export Report (shown when the incident report module is included in your license). On the report page, choose Intermediate Report or Final Report; the Tasks section lists the incident's tasks. Click Export to download the report as PDF.
-
Incident Managers can use these reports to assess the team's efficiency and identify bottlenecks in the incident response process.