Skip to main content
Use this page to act on Acronis EDR incidents after you have read them. Company users start with the AI Assistant. MSP staff can use the ticket, meeting, and Planner shortcuts on Security > EDR Incidents.

​
Before you start

  • You need Security read access and an active Acronis integration. See Read Acronis EDR incidents.
  • Add to Meeting needs Calendar write access. Add to Planner needs Planner write or manage access. The Planner item is created only if your role allows it.
  • Select incidents from one company at a time. MSPortal shows Please select items from the same company otherwise.

​
Request an investigation as a company user

1

Open Home

Open Home and find the AI Assistant.
2

Describe the incident

Include the company, incident number, host, severity, and the date shown in the Detected column.
3

Answer any questions

Reply to anything the assistant asks, then review the request.
4

Confirm the request

Confirm when prompted, then check the ticket confirmation. Viewing an incident does not create a ticket.
See How to open a ticket for the full flow.

​
Create a ticket draft

1

Choose Create Ticket

On Security > EDR Incidents, open the three-dot Actions menu on one row and choose Create Ticket. For several incidents, check their rows and choose Create Ticket from Actions (N) in the page header.
2

Paste the details

MSPortal shows Incident details copied to clipboard and opens the new ticket page. Paste the copied text into the ticket description. It lists host, severity, verdict, category, state, detected date, and the Acronis link.
3

Complete and submit

Choose the company, fill in the required fields, check every host in the pasted text, and submit the ticket.
This shortcut does not submit a ticket or fill the form for you. If the paste is empty, copy the incident details by hand from the side panel.
If you change the company or leave the EDR tab while the clipboard request is pending, its delayed result does not open a ticket page or show a confirmation. Start Create Ticket again from the incident you want to use. If copying fails while you are still on the same view, MSPortal keeps that view open and shows an error.

​
Add incidents to a meeting agenda

1

Choose Add to Meeting

Open the row’s Actions menu and choose Add to Meeting, or check several rows and choose Add to Meeting from Actions (N).
2

Check the items

In Add to Meeting Agenda, review Items to add and the company name.
3

Select the meeting

Open Select Meeting, pick an upcoming meeting, and read Current Agenda.
4

Save

Click Add to Agenda. MSPortal shows a confirmation and clears your selection.
Each incident becomes one text entry titled like EDR #12 - hostname. It does not update when Acronis changes the incident.

​
Create a Planner item

1

Choose Add to Planner

Open the row’s Actions menu and choose Add to Planner, or check several rows and use Actions (N). The option is missing if your role lacks Planner access.
2

Review the draft

The dialog opens with a title, Description, Business Value, Due Date, and Private Notes. The status starts as Not Started, and the due date starts as today. Business Value starts at High when any selected incident has High severity or is Not Mitigated, and Medium otherwise.
3

Adjust and save

Change Type, Status, Assignee, the dates, the costs, Hide from company users, or the notes if needed, then click Save. Every field in the dialog is saved. MSPortal shows Added to planner.
4

Check the item

Open Planner and confirm the item and its notes.
Several selected incidents become one Planner item titled EDR Incidents (N items). The incident details are copied into Private Notes. They are a snapshot and do not update when Acronis changes.

​
Troubleshooting

​
Frequently asked questions

No. It copies the details and opens the new ticket page. You paste, complete, and submit.
No. They create one Planner item. A meeting agenda gets one entry per incident.
No. They are a copy of the details at the time you saved.
No. Remediate the incident in Acronis.