> For the complete documentation index, see [llms.txt](https://docs.interlynk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.interlynk.io/product-guides/security-and-compliance/incident-alerts.md). # Security Incident Impact Alerts Security Incident Impact Alerts surface malicious-package supply-chain attacks before a CVE exists. When a campaign like Shai-Hulud is confirmed, Interlynk flags the affected package versions and identifies exactly which products across your organizations contain them, so teams can respond ahead of the CVE process. {% hint style="info" %} Security incident tracking is available on all plans, including free and trial organizations. Free and trial organizations can create, manage, and review security incidents. {% endhint %} *** ## How It Works An incident tracks a malicious-package supply-chain event from confirmation through remediation: 1. **Open an incident** for the confirmed campaign. 2. **Mark affected component versions** — enter them manually or import from a CSV. 3. **Scan SBOMs across organizations** to find the products that contain the affected versions. 4. **Review impact** from the dashboard to see which products are affected. 5. **Suppress findings** that don't apply to your context. 6. **Publish or resolve** the incident as remediation lands. *** ## Organization Impact Timeline The customer incident view includes a timeline showing how an incident's impact across your organization evolved over time. The timeline is backed by an actor audit trail, so you can see who changed what and when as the incident moved from confirmation through remediation. *** ## Automation with Service Tokens Security incidents can be created and managed programmatically using service tokens, so you can integrate incident workflows into automation. See [API Key Management](/administration/api-key-management.md) for token setup. *** For help interpreting impact results, contact .