Security incidents
Open Admin → Security incidents to work with Incident cases. The page brings together case facts, candidate operational signals, evidence, communications and human decisions. For example, after a token is exposed, record the affected systems, actions taken and responsible person's assessment here. Your team creates and updates these cases; containment, escalation and messages follow your existing incident procedure. Ennea does not determine whether a personal-data breach occurred or send notifications.
Access and preparation
Cases belong to the authenticated tenant. Tenant-level privacy_incident.read permits reading; .manage permits case facts, evidence and communications; .decide permits decision records; .export permits the minimized export. Ask your administrator for the appropriate grant and complete additional authentication when requested.
Use the approved incident intake and restricted evidence system for original reports, logs and notices. In Ennea, enter useful minimum facts and references. Do not paste credentials, private message bodies or unnecessary personal details into exportable summaries.
Open a case
- Open Admin → Security incidents → New case.
- Enter a clear title, relevant description, type, severity and discovery time.
- Choose Create case and retain the resulting reference.
- Add data categories, affected systems, candidate person categories, likely consequences and mitigations in Case facts, then choose Save changed facts.
- Record awareness time only after the responsible person establishes it.
Types include security, personal data, availability, integrity, confidentiality and other. Severity ranges from unassessed to critical. Use the status to track triage, investigating, contained and monitoring. Severity and status organize work; they are not notification decisions.
The displayed 72-hour planning reference is calculated from recorded awareness time. It is a planning aid, not a determination of when a legal deadline begins or whether any notification is required.
The case list loads the 50 most recently updated cases. Search and status filters apply to that list. Read-only accounts can inspect existing cases; case management access is required to create or edit them.
Change facts and affected references
Separate list entries with commas. Save submits the fields you changed. Existing details for retained system names and person categories, including system identifiers, impact descriptions, estimates and reference digests, stay with those entries. Removing a name or category also removes its associated scope details from this case. Discard changes restores the currently loaded facts.
Other tenant references are stored as digests, so the original references cannot be recovered in this editor. An ordinary facts save preserves them. To replace them:
- Select Replace references.
- Enter the Replacement reference list, separated by commas. This is a full replacement, not an addition to the stored list.
- Review the replacement warning and explicitly confirm it, then save changed facts.
An empty confirmed replacement removes the other affected-tenant references. The case's owning tenant remains. Keep original reports and sensitive details in the approved incident system and use the minimum facts necessary here.
Correlate signals and preserve evidence
Review System events to review, select the relevant events and choose Link selected events. The latest 50 eligible failure, security or exception signals are offered for review; events already linked to this case are hidden from the candidate list. These are suggestions, not confirmed incidents. Correlation retains a minimized snapshot of event identity/type, source and timing rather than copying its raw payload.
Use Add evidence for an observation or document reference. Enter the summary and source reference. Where source content is supplied for an integrity digest, the field does not store that original content as a document; keep the original in the approved evidence system.
Inspect Timeline and Evidence after saving. Evidence records are append-only; add a later correction/context record rather than expecting to overwrite an earlier observation. An integrity digest supports record consistency and does not independently prove the truth of a report.
Record communications and decisions
Use Record communication after a communication through the approved channel. Record direction, party role, channel, summary and contact/message references. This action records evidence; it does not send a message or prove delivery independently of your referenced records.
An authorized decision-maker uses Record decision to select decision/outcome and record rationale, advisor reference and human-approved notice reference where applicable. Separate decisions cover breach determination, authority notification, data-subject notification, controller communication and closure/reopening.
Decisions are attributed to the signed-in person and appended to history. Correct a later assessment with a new decision. Close/reopen through the case-closure decision; the ordinary status selector does not replace it. Perform actual containment, recovery and communications through their approved operational procedures.
Export and recovery
Choose Export evidence when authorized. The confidential JSON export includes minimized structured case/timeline evidence and integrity information while excluding much free text and notice wording. It is an evidence package, not an approved notification letter. Store and share it through your organization's approved channel.
If a save or evidence append returns an uncertain result, reopen the case and inspect its timeline before repeating. For denied access, check tenant-level grants and authentication. If a signal is no longer available, preserve an authorized source reference instead of inventing missing event data. If closure is unavailable, verify decision access and the current case state.
See System events, Privacy requests, security and deployment and support.