Creating Incidents

There are four main ways to create incidents in the Adversarial platform: through API integrations, by adding a single incident manually, by bulk importing via CSV, or by importing a narrative document with AI.

API Integrations

Any incident that comes in from your integrated tools will automatically display in your Incident Register. No manual action is required once the integration is configured.

Manual Entry

Click the Add Incident button, and a new incident record will appear at the top of your register. From there, populate the relevant fields to begin tracking the incident.

CSV Import

To bulk create incidents using a CSV file:

1. Click the dropdown menu next to the Add Incident button and choose Import CSV.
2. Download the template.
3. Fill out the template, save as CSV, and upload.

Caution

Follow the formatting provided in the template carefully:

• Dates must be in YYYY-MM-DD format.
• Status and Source must match the platform’s values exactly, including capitalization. Severity is more forgiving, but using the template’s values (SEV-1 through SEV-5) is the safest route.
• The Comments field cannot be populated via CSV import.
• The file must be saved as CSV file type.

CSV Field Reference

Field Label	Format	Notes
title	Text field	No character limitation
description	Text field	No character limitation
severity	Dropdown field	Case sensitive; view the CSV download template for available default values
status	Dropdown field	Case sensitive; view the CSV download template for available default values
source	Dropdown field	Case sensitive; view the CSV download template for available default values
detected_date	YYYY-MM-DD	The date when the incident became known
occurred_date	YYYY-MM-DD	The date when the incident began
responded_date	YYYY-MM-DD	Date where response procedures were initiated
contained_date	YYYY-MM-DD	The date at which the impact of the incident is substantially abated

Import via AI

To import incidents from a narrative document — a post-mortem, an incident response report, a vendor breach notification, an after-action memo — click the dropdown menu next to the Add Incident button and choose Import via AI. Upload a text, Markdown, PDF (with selectable text), or Word (.docx) document, and the AI proposes a set of candidate incidents drawn from it. Risks can be imported the same way; see Creating Risks.

For each candidate incident, the AI drafts a Title, Description, Source, Severity, and Detected and Occurred Dates, along with the verbatim passage of the document it was drawn from. Extraction is grounded in the document: where the document states its own severity, it is mapped to the SEV-5 to SEV-1 scale as a starting point, and where it doesn’t, Severity is left empty. Detected and Occurred Dates come from the document when it gives them. Source is matched to one of your organization’s configured incident sources.

Each proposal is shown side-by-side with the source document: click a proposed incident to highlight the passage it was drawn from, and edit any of its fields before importing. Discard any proposals you don’t want, and optionally tag the whole batch, for example with the report name. Only the incidents you approve are added to the register when you select Import; nothing is committed automatically. See AI Features for how AI is used across the platform.

The same upload limits and file support apply as for risk import, including the note that scanned-image PDFs can’t be read. You can import up to 500 incidents at a time. The import is all-or-nothing: if any part of it fails, no incidents are created and no tags are applied. Imported incidents arrive in the New status, ready to be scored like any other new incident.

The document you uploaded is attached to every incident created from it. Open any imported incident and the original report is in its Attachments section — see Incident Fields — Attachments. If the document can’t be attached, the incidents are still imported and you are told that the attachment wasn’t added.

Importing this way requires incidents:write, plus tags:write if you tag the batch. See Managing Roles.

Bulk Delete

To delete multiple incidents at once, select the incidents using the checkboxes in the table view, then click the Delete button in the bulk actions toolbar. A confirmation dialog will appear before the incidents are permanently removed.

Caution

Bulk delete is permanent and cannot be undone. Verify your selection before confirming.

Risk and Incident Linking

Incidents and risks can be linked to track relationships between them. From the detailed view of an incident, use the Risk Register Referral section to associate related risks or create new risks identified during incident investigation. See Incident Fields — Risk Register Referral for details.