Progress the incident through three response phases as appropriate:

Containment – implement immediate measures to prevent further impact. Document each containment action as a timeline entry with the type "action taken". Examples: disabling a compromised endpoint, revoking access tokens, isolating an affected service.

Remediation – address the root cause. This might involve deploying a patch, updating a dependency, reconfiguring access controls, or rotating credentials. Record each remediation step in the timeline.

Recovery – verify that normal operations have been restored and that the remediation was effective. Confirm that monitoring is in place to detect recurrence.

If this incident has a linked CRA Article 14 report, the AI Copilot can help draft the notification and final report stages. Open the linked CRA report and use Draft with AI (prompt key: incident_report_draft). The Copilot uses the incident's product data, linked vulnerability findings, and timeline context to generate regulatory-quality report content. 5 calls per report per day.

Phase transitions are sequential – you cannot skip phases. Each transition records who made the change and when, creating an immutable compliance evidence trail per CRA Article 13(10).

Internal incident management

Select a station to begin