# How To Review and Manage Grouped Incidents With BetterShield?

Use the Incidents tab to review open correlations, refresh evidence, and move completed reviews to Handled.

In **[BetterShield](/)**, the **Incidents** tab groups related access and executable-file activity.

## What it does

The summary shows **Open**, **Evidence**, **Last correlation**, and **Waiting**. **Refresh evidence** runs the correlation step again. The list separates **Open** from **Handled** and keeps the underlying records linked to each group.

An empty view explicitly does not claim that the site is clean. The Files report and open findings remain separate sources of evidence.

<span id="set-it-up" aria-hidden="true"></span>

## Step 1: Review and Manage Grouped Incidents

No switch is required. Keep site activity and file checks available. Select an incident to open its details, and mark it handled after the review is complete.

<figure class="doc-shot">
  <img src="/docs/screenshots/incident-records.png" alt="Incidents tab with Open and Handled views, evidence totals, last correlation time, and Refresh evidence." width="1964" height="482" loading="lazy" decoding="async">
  <figcaption>Open and Handled are review states for grouped evidence, not verdicts about intent.</figcaption>
</figure>

## Recommended settings

Review the newest open group first. Record why it was handled in your own operational notes, especially when the activity was expected.

## What it can break and how to undo

Changing the review state does not alter accounts or files. Return a handled group to the open view if more review is needed.

<span id="check-it-is-working" aria-hidden="true"></span>

## Final Outcome

Select **Refresh evidence** and confirm **Last correlation** updates. Moving a group to handled should change both view counts.

<figure class="doc-shot">
  <img src="/docs/screenshots/incident-records.png" alt="Incidents tab with Open and Handled views, evidence totals, last correlation time, and Refresh evidence." width="1964" height="482" loading="lazy" decoding="async">
  <figcaption>Example Incident records view. Check the saved values and status on your own site.</figcaption>
</figure>

## Related

- [Read an incident's evidence and related activity](/docs/incident-evidence/)
- [Prepare and apply an incident response plan](/docs/incident-response-plan/)
- [File changes](/docs/file-changes/)

This is how you can review and manage grouped incidents with BetterShield.

Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).