Incident Lifecycle: From Detection to Closure

Incident lifecycle: from detection to closure

An incident in Petra goes from the moment it's detected through triage, response, and finally closure. Understanding this lifecycle helps you manage your queue, report on progress, and make sure nothing falls through the cracks.

Detection and creation

When Petra identifies a potential threat or suspicious activity, it creates an incident and links it to a user and tenant. The incident appears in your incident list with an initial severity and confidence. You may also receive a notification if you've configured alerts for new or high-severity incidents. At this stage, the incident is typically "open" and awaiting review.

Triage and investigation

Your team reviews the incident: you open it, look at the timeline and signals, and decide whether it's a true positive and how serious it is. You might add notes, update the remediation status (for example, to "in progress" or "remediated"), and record the actions you're taking. Triage might lead you to lock the account, reset the password, delete a malicious email from mailboxes, disable an inbox rule, or take other remediation steps. Petra may suggest recommended actions; you choose which to perform and when.

Remediation status

As you work, you update the incident's remediation status. Common statuses include: remediated (you've addressed the issue), partially remediated (some steps done, more needed), unremediated (not yet addressed), incorrect (false positive—no real threat), locked awaiting password reset (account is locked and you're waiting for a password change), and similar. Keeping status up to date lets everyone see what's done and what's still open. You can also record each remediation action (lock account, reset password, etc.) so there's a clear history of what was done and when.

Closure and reporting

When the incident is fully handled, you set its status to something that indicates closure (e.g., remediated or incorrect). Closed incidents remain visible for reporting and audit—you can run reports on how many incidents were remediated, how long they took, and so on. That way the incident lifecycle supports both response and accountability.