Complete these steps for each component in the Response Team, External Providers, Network Information, and Incident Escalation sections.

1. Sign in to the Arctic Wolf Unified Portal.
2. In the navigation menu, click Incident Response > IR Planner.
3. If you want to:
   • Fill in an existing component — Next to the component that you want to complete, click > Edit Details.
     Note: Some fields are populated with default values. We recommend that you edit these for your organization.
   • Add a new component — Click Add Team Member, Add External Provider, or Add Network Information, depending on the section you are in.
     Note:

     • We recommend completing existing components before adding a new component.
     • You cannot add new components to the Incident Escalation section.
4. Enter the information for that component.
   Note: You can reuse any contacts that you add in other sections of the IR Planner. These contacts are not related to the contents of the Contacts section of the Unified Portal.
5. Click Save Changes.
6. Optional: In the Comments field, enter a comment and click Submit.

1. In the Critical Systems section, add business functions that are high priority in the restoration process after a security event:
   1. Click Add Business Function.
   2. Enter details about the business function.
   3. Click Save Business Function.
   4. Optional: In the Comments field, include any additional relevant information.
2. For each business function, add critical systems:
   1. For the business function, click > Add System.
   2. Select the type of system or select an existing system.
   3. Enter details about the system.
   4. Click Save System.