Short answer: Let people report through the channels they already use, but convert every report into one structured incident record with a minimum field set, a routing rule, an owner, and a link to the original message or alert.
Define the minimum intake
Collect only what is needed for the first decision:
- What was observed and when.
- Who or what reported it.
- Affected user, asset, service, or data if known.
- Source links, indicators, and attachments.
- Current impact and actions already taken.
Use “unknown” where necessary. Do not force a reporter to make a severity or root-cause judgement they cannot support.
Make each channel predictable
Slack should provide a visible reporting path without becoming the system of record. Email should use a monitored address and a standard subject or parsing rule. A web form should use clear prompts and preserve attachments and timestamps. All three should create or update the same queue.
Route and acknowledge
Route by type, service, location, or urgency. Record the time received and who accepted the report. If the first recipient is not the incident owner, create a handoff with the next action and due time.
Deduplicate without deleting context
Group repeated reports when they describe the same event, but retain the source messages and reporters. Link related alerts instead of erasing evidence of how the issue was first observed.
Hand off to triage
Intake should stop when the record has enough information for triage. Classification, enrichment, response tasks, and RCA belong to the next stages. Keeping those stages separate makes the intake form shorter and the workflow easier to measure.
Practical example
An employee reports a suspicious message in Slack while a monitoring tool sends a related alert by email. Both reports should create or update one incident record with the source links, observed time, affected user, initial impact, owner, and next action. The channel is not the system of record.
FAQ
What information should incident intake require?
Capture what happened, when, affected user or asset, source link, current impact, reporter, owner or queue, and the next action. Allow unknown values.
Should every report become an incident?
No. Triage can link duplicate or low-impact reports to the right record while preserving the original source.
Sources and further reading
- NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations
- NIST Cybersecurity Framework 2.0