Creating Incidents Creating a custom incident will bypass all incident rules and is a convenient way to flag a user and/or device when necessary. Custom incidents can revoke data access and provide a data recovery point. The configurable options when creating an incident are: Type - Provides a type of Security/Incident, but can be changed to a custom value. Threat Level - (Optional) Used to indicate the severity of the incident with an increasing severity range of 0-10. User - (Optional) Select a user to block system wide access. IP Address - (Optional) Provide an IP address to block system wide access. Dataset - (Optional) Select a Dataset/Pool to reference with this incident. Specifying a location will not limit the scope of the block. Add Note - (Optional) Provide a reference note to include with this incident. The following steps create an incident to block John Doe: Navigate to the Incidents - Summary Page. Click Create Incident. Click Select User. Search for John Doe’s username. Select John Doe’s user account and click Select User. Check the box labeled Block User to apply an access block to John Doe. Click Create.