This topic explains how to associate and disassociate events in the Workflow module.
There are two types of associations between events: horizontal and vertical. In the first, events are associated with each other directly, allowing events created for similar issues to be linked to each other, regardless of their status or event type. These are known as "related events", which can be associated through the main list of events. Any changes made to a related event will not affect the percentage of progress or status of its associated events. In other words, a closed event can be associated with another closed event and, once one of them is reopened, the other one will keep its current status.
In the second type of association, events can be associated as subordinate events beneath a main open event. These are known as "child events", and they may represent sub-tasks that must be finished before a main task (the parent event) can be considered complete, for example. They can be created directly within an event, or associated with a parent event through the main list. Each child event can have multiple levels of child events of its own; however, an event cannot be the child of two different parent events.
In risk treatment events, this feature can be used when sending non-implemented controls for treatment. A parent event can be create for an asset, with a child event created for each non-implemented control related to the asset. Likewise, events treating different vulnerabilities identified in the same asset can also be associated with a common parent event, so as to group all occurrences of that vulnerability by asset.
Events from different projects can also be horizontally associated so as to link events that might share common information. This way, an event created from a project to treat vulnerabilities arising from illegal spyware in computers can be linked to an event from another project that includes the implementation of anti-virus controls, for example.
Events of all types can be associated with a parent event of any type, and events with any status can be associated as child events; however, only open events can be associated as parent events. To do so, you must have permission to both the child events and the parent event. To disassociate them, you must have permission to the parent or child event you want to disassociate.
Note that events only support one type of association at a time, meaning that a child event cannot be horizontally associated with its parent or vice-versa (see figure below). However, child events support horizontal associations normally with events they are not already associated with.
When an event is associated horizontally with another event (for example, Event A with Event B in the figure above), child events below it will not be associated with that event.
In the Associated Events tab of an event, you can select each event you would like to disassociate from the main event. Through this tab for Event A, if you select Event B to be disassociated, Event A and its child events will be disassociated from Event B. Nonetheless, Event C and Event D will continue to be child events of Event A.
In addition, an option is available in the main list that allows you to disassociate events. Note though that this option will disassociate all the events directly associated with the events you selected, but will not disassociate a child event that is a parent to another event (see figure below).
When Event A is selected for disassociation through the main list of events, its horizontal association with Event B will be broken off, and the same will happen with its associated child events – Event C and Event D. However, Event C will continue to be associated Event F and Event D will still be horizontally associated with Event E.
It is also important to note that events of different levels can be freely associated. For example, Event G can be horizontally associated with Event B, even though Event G is a third-level child event and Event B has no vertical associations.
The association and disassociation between related events and parent-child events is recorded in the progress history of those events, including in the progress history of closed or canceled events. Changes in the status of a parent event may also affect the status of its child events. For details, see the following topics: Chapter 10: Workflow -> Events -> Closing Events, Cancelling Events, Reopening Events, and Deleting Events.