About Incident Severity

About Incident Severity

Each incident, issue, or event in ThinkShield Firmware Assurance (TSFA) is assigned a Severity Level, indicating its importance and suggesting potential actions for the affected device. Severity levels help administrators prioritize issues for resolution. 
The level is determined by the event’s status and type. Events classified as Normal are considered current and are not displayed on the Incident page.

Severity scale: 

  1. Normal: Expected event; not an incident; no action required.
  2. Low: Unexpected incident with minimal impact.
  3. Moderate: Unexpected incident with higher impact; also, the default for new or unknown events/statuses.
  4. High: Unexpected, serious issues; by default, includes intrusions and security violations.

Viewing Severity Levels

I. Go to Device Insights > TSFA Security and select All Incidents. The table displays current incidents with detailed information.
Sort and Filter by Severity:
  1. Click the arrow next to Severity. Use the downward arrow for Low → High, or the upward arrow for High → Low.
  2. To use the Filter:
    1. Click Filter.
    2. Select one or more severities from the left pane and check the corresponding boxes.
    3. Click Apply.
II. On the All Incidents page, select an Incident from the list. The Device tray shows its status in the top right corner.

III. Use Device Lookup.
  1. Go to Device Management > Devices.
  2. Select the device associated with a specific incident.
  3. In the Device tray, click the three-dot menu from the top right corner.
  4. Select Inspect Device (this redirects to Device Insights). Device Lookup details will populate.
  5. In the Events Log (right section) view the list of events associated to the device.
  6. Each event has a red icon; hover the cursor over the icon to see the Severity level.

Setting Up Severity Levels 

  1. Because each organization has unique priorities, Org Admins and IT Admins can override the severity levels defined by the Solution Admin for their organization.
  2. From the top dropdown menu, select Configuration & Settings.
  3. In the left panel, select Organization Settings > TSFA Settings.
  4. On the TSFA Settings page, open the Incident Severity tab.
  5. A list of incident types and statuses is displayed. Each incident type has a recommended severity set by the Solution Admin and is labeled with (default).
  6. To change a severity level, click the arrow and select another value from the dropdown list. Repeat as needed.
  7. Click Save.
You can revert to the Solution Admin’s default settings at any time. To reset all values at once, click Reset all to default and confirm the warning prompt.
Alert
 All changes will be applied to past and future events.

Viewing Severity Distribution across the organization

  1. Navigate to the Dashboard.
  2. Scroll the page to Severity Distribution. The widget shows all incidents within the organization grouped by Severity.
    The legend is interactive and includes links that redirect to the Incident table filtered by Severity.


    • Related Articles

    • Setting Up Incidents

      This feature lets users customize alert preferences by incident severity: Low and higher, Moderate and higher, or High only. When an incident meets the selected severity, users are notified via a portal message and, optionally, email. Both ...

    • Setting Up LDO ServiceNow Integration

      Prerequisites Before configuring the integration between LDO and ServiceNow, ensure the following prerequisites are met to establish proper synchronization: Terminology Alignment In LDO, a physical device (such as a laptop, desktop, or server) is ...

    • Using the Dashboard in LDO

      The Dashboard is the home page of Lenovo Device Orchestration, providing an at-a-glance overview of the devices in your organization and related information. It consists of multiple widgets, each representing a different category of device ...

    • LDO Support Matrix

      This matrix provides a high-level overview of the specific operating systems and environments supported by Lenovo Device Orchestration (LDO) for its key management features. It clearly displays the availability of functions—such as remote power ...

    • Lenovo Device Orchestration Release Notes v.26.01

      Components Release Version Availability Date Lenovo Device Orchestration 26.1 Feb 5 2026 User Device Services (UDS) Cloud Portal/Frontend 26.1 Feb 5 2026 Universal Device Client (UDC) Agent Windows UDC 25.12.1.4 Windows UDC ARM 25.9.0.49 Linux UDC ...