{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43876,"path":"security-management/data-loss-prevention/configure-end-user-action.md","title":"Create incident response option rules","bundle":null,"doc_type":null,"release":"australia","body":"\n# Create incident response option rules\n\nCreate the incident response option rules that end user or analyst can use while responding to an incident.\n\n## Before you begin\n\nRole required:\n\n-   sn\\_dlir.admin - Create, edit, and delete.\n-   sn\\_dlir.analyst and sn\\_dlir.analyst\\_read - View \\(read-only\\).\n\n## About this task\n\nYou can configure the type of response that an end user should perform based on the type of DLP incident. The base system DLP Incident Response application provides the following response options for users:\n\n-   Assessment Complete\n-   Deleted Content\n-   Deleted File\n-   Encrypted File\n-   Masked Content\n-   Report false positive\n-   Report wrong owner\n-   Required for Business Process\n-   Reviewed Entitlements\n\nFor example, let's say that an end user reports a DLP incident as a false positive. The state for this incident is then automatically marked as closed because the target state that is configured by you is closed.\n\n## Procedure\n\n1.  Navigate to **All** &gt; **DLP Administration** &gt; **Incident Response Option Rules**.\n\n2.  Click **New**.\n\n3.  On the form, fill in the fields.\n\n<table id=\"table_vvq_l5k_zrb\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nName\n\n</td><td>\n\nName of the incident response option.\n\n</td></tr><tr><td>\n\nActive\n\n</td><td>\n\nOption to indicate whether the incident response option is active.\n\n</td></tr><tr><td>\n\nExecution order\n\n</td><td>\n\nPriority of the incident response option. This field indicates the order in which the incident response options are executed when two or more incident response options share the triggering conditions.The incident response option with the lowest number has the highest priority.\n\n To set the order of operation, enter a value. For example, 100, 200, or any other number.\n\n The default is 100.\n\n</td></tr><tr><td>\n\nDescription\n\n</td><td>\n\nUnique description for this incident response option.\n\n</td></tr><tr><td>\n\nDefault target state\n\n</td><td>\n\nThe default target state that you configured.\n\n</td></tr><tr><td>\n\nCondition\n\n</td><td>\n\nConditions in the condition builder. These conditions are based on the DLP incident table. To build a condition for the incident response options, select any of the incident fields.Use the lists and fields of the conditions builder to set the filters for the first row.\n\n To add more conditions, click **AND** or **OR**:\n\n-   If **AND** is selected, all conditions must be matched.\n-   If **OR** is selected, either condition can be matched.\n To set a second filter condition, click **New Criteria**.\n\n**Note:** The conditions in the condition builder are case sensitive.\n\n</td></tr></tbody>\n</table>    The following example shows the end-user action configuration for an endpoint. The condition requires the scan source to be an endpoint file system that then triggers this end-user action configuration. The mapping shows that the report wrong owner, report false positive, and deleted file are the response options available to the end user.\n\n4.  In the **Response Option Mappings** section, click **New**.\n\n5.  On the form, fill in the fields.\n\n<table id=\"table_wrk_qyk_zrb\"><thead><tr><th>\n\n \n\n</th><th>\n\n \n\n</th></tr></thead><tbody><tr><td>\n\nResponse Option Rule\n\n</td><td>\n\nName of the incident response option rule. For example, `SharePoint` implies that the scan source is SharePoint. You can either enter the name of the incident response or look up using search.\n\n</td></tr><tr><td>\n\nResponse Option\n\n</td><td>\n\nOption to select the response option. You can either enter the response option or look up using search.\n\n</td></tr><tr><td>\n\nTarget State\n\n</td><td>\n\nThe target state of the DLP incident after the end user selects the appropriate action.**Note:**\n\n1.  The **Target State** field will appear only when you select **Response Option** which is of **Type: Basic**. For more information on how the target state types are configured, see [Configure response option for your DLP incidents](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/data-loss-prevention/configure-response-option-mapping.md).\n2.  When a Response Option which is of **Type: Advanced** is selected, you will not be able to set the Target State and will be hidden. The Target State will be assigned based on the custom state that is configured from the flow designer sub flow.\n\n\n</td></tr><tr><td>\n\nShow response options for\n\n</td><td>\n\nOption to determine the user roles to show the response options for.You can choose from **Analyst**, **End user**, and **Escalated Analyst Reviewers** by using the unlock option. You are allowed to choose one or all the roles.\n\n</td></tr></tbody>\n</table>6.  Click **Submit**.\n\n\n**Parent Topic:**[DLP Incident Response Administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/data-loss-prevention/data-loss-prevention-administration.md)\n\n**Related topics**  \n\n\n[DLP default configuration settings]()\n\n[Create end user lookup rules]()\n\n[Create assignment rules]()\n\n[Create incident consolidation rules]()\n\n[Create response due date rules]()\n\n[Create Approval Rules]()\n\n[Create user instructions templates]()\n\n[Create email templates]()\n\n[Create a Data Loss Prevention Incident Response SLA trigger]()\n\n[Create a Data Loss Prevention Incident Response SLA definition]()\n\n[Create assessments]()\n\n[Configure response option for your DLP incidents]()\n\n[Create age chart configurations]()\n\n[Create user delegate configurations]()\n\n[Create repeat offender identification rules]()\n\n[Create additional incident data fields]()\n\n[DLP SLA Definition form]()\n\n[Configure advanced settings]()\n\n[Monitor DLP Integration Run process]()\n\n[DLP Incident Access Restrictions]()\n\n[DLP Incidents Archival]()\n\n"}}