Incidents and playbooks

A checklist for each security situation, so nothing is forgotten under pressure, with a full audit trail.

Steps

1. 1

   Open Admin console › Security › Risky sign-ins & incidents and choose New incident, or Open incident next to a risky sign-in.

2. 2

   Pick the playbook: compromised account, lost device, departed employee, phishing click, breach exposure or insider risk.

3. 3

   Work through the steps. Sign out everywhere runs from the checklist; the other steps link to the page that does them.

4. 4

   Resolve the incident when done. The median time to resolve is shown at the top; the API serves incidents at GET /v1/incidents.