> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Incidents Classification Workflow

[Incidents](https://docs.humansecurity.com/applications-and-accounts/docs/cd-glossary#incidents) can go through several phases:

* **Unclassified:** These appear in the **Unclassified Incidents** tab. The initial state of each new incident. The incident is considered unclassified until it's moved to Under Review or added to either the Allow list or Deny list.
* **Under Review:** These appear in the **Incidents Under Review** tab. This is an optional state where the incident can be marked for further inspection to better assess whether its behavior is either:
  1. Should be allowed and added to the Allow List, or
  2. Should be prevented and added to the Deny list
* **Classified:** The incident has been added to either the Allow List or Deny List and is no longer shown on the Dashboard.

![](/_fern-files/_img/1821a4e050056ade5090663d16eb8a2a1a72bec0cb7c483f42f65c6a7358ace8.webp)

## Workflow

### 1. Move an Incident to Under Review

When a script's behavior should be verified by a specific individual or team, you should click the relevant incident and choose **Move to Incidents under review**:

![](/_fern-files/_img/a301cd23b068c65814eda473b7dfb5739c4c5302b4b7d9d97355409da5a4c933.webp)

This opens the **Move to Incidents Under Review** window. From here, you can:

* Create and add labels to the incident
* Create a Jira ticket from the incident
* Send a Slack message of the incident
* Send an email of the incident
* Create a custom integration

![](/_fern-files/_img/5a59dba0596cab523d1e64e6325c645ce82638843fcc4c631ac6782d05eaf4d2.webp)

Once you're done, click **Move to Under review & share.** This updates the incident and moves it to the **Incidents Under Review** tab. After your team inspects the incident and there's a better understanding of the specific script’s behavior, you can safely allow or deny the incident.

### 2. Add an incident to an allow or deny list

When a script's behavior is known and you want to either allow or deny it, then you can:

1. Click the relevant incident
2. Choose either **Add to allow list (don't show this incident again)** or **Add to deny list (block incident)**.

![](/_fern-files/_img/014c0be2aa49e61db948c6a13fbead435c9dc8db9bae1e8e485e3973ea2012c5.webp)

Upon approval, the [actions](https://docs.humansecurity.com/applications-and-accounts/docs/cd-glossary#actions) corresponding to the denied incident will be added to **Policies > Allow List** or **Policies > Deny List** depending on your selection.